- cross-posted to:
- technology@lemmy.world
- cross-posted to:
- technology@lemmy.world
The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
Shouldn’t especially vital services be taken down to secure them?
Yep. Except if taking them down will kill people.
takes down 112 / 911 services
Don’t worry guys, we’re safe now! ꒰ঌ(˶ˆᗜˆ˵)໒꒱
Me when I take down only one hundred twelve out of nine hundred eleven services, leaving seven hundred ninety-nine services still running
Safe here, we use 999
round these parts we use 0118 999 881 999 119 725 3
We’re YOUR emergency services
As if those are running anything as recent as php.
For their interactive mapview in the control room they probably do.