Widespread PHP Flaw

[hecatae]

Widespread PHP Flaw May Cause Many Site Outages Today – Krebs on Security

Anyone else seen pbx software affected?

 

[drmurdoch]

Are incrediblePBX boxes impacted ?

Must be.

 

[hecatae]

Are incrediblePBX boxes impacted ?

Must be.

The bugs are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

What are you running if you type php -v in ssh

I'm apparently running 8.2.35

 

[atsak]

They are affected but I would hope you don't have your web interfaces exposed to the internet . . . like yikes.

NVD - Home

nvd.nist.gov

 

[hecatae]

Today's PHP Security Release, and How We're Strengthening PHP Security

Describing the story behind how critical security vulnerabilities were found and fixed.

thephp.foundation

The statement from the php foundation explains what's happened.

Now the question remains why is the php foundation underfunded?

 

[drmurdoch]

They are affected but I would hope you don't have your web interfaces exposed to the internet . . . like yikes.

Almost every website in the world has web interfaces exposed to the internet, non ?

This website does (Xenforo), Wordpress does. 70% of all websites in the world are php.

 

[hillclimber]

Urgent security fix issued for code vital to estimated 70% of all websites

The code vulnerability could allow attackers to take over servers, experts say.

abcnews.com

‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.

www.wired.com