Widespread PHP Flaw

[hecatae]

Widespread PHP Flaw May Cause Many Site Outages Today – Krebs on Security

Anyone else seen pbx software affected?

 

[drmurdoch]

Are incrediblePBX boxes impacted ?

Must be.

 

[hecatae]

Are incrediblePBX boxes impacted ?

Must be.

The bugs are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

What are you running if you type php -v in ssh

I'm apparently running 8.2.35

 

[atsak]

They are affected but I would hope you don't have your web interfaces exposed to the internet . . . like yikes.

NVD - Home

nvd.nist.gov

 

[hecatae]

Today's PHP Security Release, and How We're Strengthening PHP Security

Describing the story behind how critical security vulnerabilities were found and fixed.

thephp.foundation

The statement from the php foundation explains what's happened.

Now the question remains why is the php foundation underfunded?

 

[drmurdoch]

They are affected but I would hope you don't have your web interfaces exposed to the internet . . . like yikes.

Almost every website in the world has web interfaces exposed to the internet, non ?

This website does (Xenforo), Wordpress does. 70% of all websites in the world are php.

 

[hillclimber]

Urgent security fix issued for code vital to estimated 70% of all websites

The code vulnerability could allow attackers to take over servers, experts say.

abcnews.com

‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.

www.wired.com

 

[KNERD]

For those using older distros which are EOL there are couple of which can be done:

Recompile PHP with this patch:

GitHub - php/php-src at PHP-7.4-CVE-2026-109618-109619

The PHP Interpreter. Contribute to php/php-src development by creating an account on GitHub.

github.com

The PHP project lists configuration measures that reduce exposure but, in their own words, do not make the installation safe. Treat this as a temporary step until you can update PHP, not as a fix:

• session.upload_progress.enabled = 0
• memory_limit = -1 (set so it cannot be overridden per application; see the caution below)
• post_max_size kept low (see the ASTPP note below)
• upload_max_filesize kept below post_max_size

Apply these in php.ini or your FPM pool configuration, not with ini_set() or .user.ini, and restart every PHP worker afterwards.


Two cautions specific to ASTPP, please read before applying:

• ASTPP uses file uploads for rate card and DID imports. If you set post_max_size too low, large imports will fail. The PHP advisory suggests 32M where uploads are needed. Set it based on your largest import, and test an import after applying.
• memory_limit = -1 removes the PHP memory ceiling. This is the PHP-recommended mitigation, but it means a single request is no longer capped, which is an availability consideration on a production server. If you can, use an operating-system level limit (container or cgroup) as the safety boundary instead, and do not use RLIMIT_AS or RLIMIT_DATA.

Always back up your existing php.ini before changing it.

 

[atsak]

Almost every website in the world has web interfaces exposed to the internet, non ?

This website does (Xenforo), Wordpress does. 70% of all websites in the world are php.

Yes, but your Freepbx based ones should never be exposed to the internet at large. Ever. Its' just not secure enough.

 

[kenn10]

Yes, but your Freepbx based ones should never be exposed to the internet at large. Ever. Its' just not secure enough.

That's why a whitelist only IncrediblePBX stock install is really not affected by this.

 

[drmurdoch]

Yes, but your Freepbx based ones should never be exposed to the internet at large. Ever. Its' just not secure enough.

3cx required me to have a split DNS, is there any security risk in that ?

 

[wardmundy]

Busy day in the WordPress world...

 

[atsak]

3cx required me to have a split DNS, is there any security risk in that ?

Not inherently, no, split DNS just basically means public and private resolve to different IP's.

 

[drmurdoch]

That's why a whitelist only IncrediblePBX stock install is really not affected by this.

That is definitely something worth bragging about. I think PIAF was very security focused and that tradition has carried on.

Not inherently, no, split DNS just basically means public and private resolve to different IP's.

So, IncrediblePBX doesn't need that because ... ? Why does 3CX essentially force it on people ? Security ? Protect their licenses ?

 

[drmurdoch]

Oct 20, 2026 4:27 PM

a quick demo of php2shell on all major website hosting software packages and how quick it is ....

Kirill Firsov (@k_firsov) on X

php2shell Tomorrow is a helluva day.

x.com

I heard having cloudflare helped.