PHP2Shell

[prpr]

A critical security vulnerability in PHP has got everybody panicking and shutting down web-sites.
https://en.wikipedia.org/wiki/PHP2Shell
XenForo (which this forum runs on) uses PHP.

 

[Black Hole]

From Hydrogen Audio:

Multiple critical security vulnerabilities have been found in PHP:
https://www.php.net/archive/2026.php#2026-10-20-1

The patch is scheduled to be released today.
Until then, to protect the integrity of our servers (forum, wiki), I'm going to shut them down (disable HTTP server) until the PHP update has been installed.
foobar2000.org has been taken offline already, being a more attractive target for potential attackers (serves software downloads which could be tampered with).

I've not noticed anything different, but perhaps that's because I'm using HTTPS (?).

 

[Owen Smith]

I've not noticed anything different, but perhaps that's because I'm using HTTPS (?).

I wasn't aware you can still use http to reach hummy.tv. Many web sites have gone https only. A quick test shows hummy.tv converts any http access to https, or Chrome at work does.

 

[prpr]

disable HTTP server

He means "web" server. Some people hang on to old names that just confuse people. The problem applies to both HTTP and HTTPS - the same server does both.

 

[Allotment]

National Cyber Security Centre – part of the UK’s intelligence & cyber agency
"The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

The exploits concern remote code execution on the affected servers (this forum is one as far as I can determine). There are reported, exploits in the wild and exploit detaiols starting to appear on social media sites.

PHP is everywhere..........

 

[Wildebeest]

A quick test shows hummy.tv converts any http access to https, or Chrome at work does.

I believe most browsers have defaulted to having HTTP site access disabled for some years now, and they'll use HTTPS if it's available on that site, giving a warning if not.

 

[Owen Smith]

He means "web" server. Some people hang on to old names that just confuse people. The problem applies to both HTTP and HTTPS - the same server does both.

I did wonder how PHP could be safe over https but not http...

 

[Owen Smith]

XenForo (which this forum runs on) uses PHP.

Do we know which version of PHP it uses and therefore whether there is an update for it?

Who's job is it to install any such update? XenForo (whoever they are) or one of 'us' (by which I mean people like af123 or Brian or other undetermined people that might have the appropriate logins).

 

[prpr]

"Whose"
Only af123 will be able to do this. XenForo have no say in it unless you're using their cloud platform, and we aren't.
They recommend PHP 8.3 but I have no idea what's in use. I've had previous contact when the repository upload platform breaks and it's usually PHP related, but anything discussed will now be out of date.
I'm (fairly) sure he will be across it.

https://xenforo.com/community/threads/police-car-light-urgent-update-your-php-immediately.240896/

 

[Owen Smith]

"Whose"

Not where I'm from in Yorkshire, it's never used that way.