Temporarily Unavailable
arstechnica.com

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

  • hereiamagain@sh.itjust.worksEnglish
    6·
    11 hours ago

    Seriously though, how quickly do you expect patches to be available for WordPress? I’ve got one WordPress site that I made years ago for a friend’s business. I pop in on it and update stuff every few months.

    Should I take it down?

    • GreenKnight23@lemmy.worldEnglish
      1·
      2 hours ago

      Should I take it down?

      depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don’t take proper backups)?

    • MouldyCat@feddit.ukEnglish
      12·
      11 hours ago

      it’s PHP that needs the patches. Yes you should take the site down until PHP has been patched.

      edit: assuming you are hosting wordpress yourself. if you’re using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.