PHP2Shell

[prpr]

A critical security vulnerability in PHP has got everybody panicking and shutting down web-sites.
https://en.wikipedia.org/wiki/PHP2Shell
XenForo (which this forum runs on) uses PHP.

 

[Black Hole]

From Hydrogen Audio:

Multiple critical security vulnerabilities have been found in PHP:
https://www.php.net/archive/2026.php#2026-10-20-1

The patch is scheduled to be released today.
Until then, to protect the integrity of our servers (forum, wiki), I'm going to shut them down (disable HTTP server) until the PHP update has been installed.
foobar2000.org has been taken offline already, being a more attractive target for potential attackers (serves software downloads which could be tampered with).

I've not noticed anything different, but perhaps that's because I'm using HTTPS (?).

 

[Owen Smith]

I've not noticed anything different, but perhaps that's because I'm using HTTPS (?).

I wasn't aware you can still use http to reach hummy.tv. Many web sites have gone https only. A quick test shows hummy.tv converts any http access to https, or Chrome at work does.

 

[prpr]

disable HTTP server

He means "web" server. Some people hang on to old names that just confuse people. The problem applies to both HTTP and HTTPS - the same server does both.

 

[Allotment]

National Cyber Security Centre – part of the UK’s intelligence & cyber agency
"The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

The exploits concern remote code execution on the affected servers (this forum is one as far as I can determine). There are reported, exploits in the wild and exploit detaiols starting to appear on social media sites.

PHP is everywhere..........

 

[Wildebeest]

A quick test shows hummy.tv converts any http access to https, or Chrome at work does.

I believe most browsers have defaulted to having HTTP site access disabled for some years now, and they'll use HTTPS if it's available on that site, giving a warning if not.