- cross-posted to:
- technology@lemmy.world
- cross-posted to:
- technology@lemmy.world
The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
Yeah, as long as your firewall is properly hardened and up to date.
And not using php for a webui