Important: Critical PHP Security Vulnerabilities

[Alexander]

Hello,

here’s a short summary of what’s coming our way today:

The PHP security team has announced an update for two critical security vulnerabilities for today, Wednesday, October 21, at 14:00 UTC (16:00 CEST). Since the update was announced in advance and both vulnerabilities are rated as highly critical, the situation is quite serious.

https://www.php.net/
https://sansec.io/research/php2shell

Overview:
There are currently two critical security vulnerabilities that allow remote code execution.
All PHP versions from 5.x to 8.5 are affected.
It is currently unknown whether older PHP versions (< 8.2) will receive updates at all. You should expect that these, if they come at all, will only be available with a delay.


Default PHP version of the operating system:
The default PHP version of the operating system is expected to be updated promptly by the operating system vendors as well.

With KeyHelp’s default settings, these updates are installed every two days between 3 and 4 a.m. If they are released during the course of today, they will be installed on Friday at the latest.
To install the updates immediately, go to “Maintenance intervals → Update server services” or run the command “keyhelp run package-update”.


Additional PHP interpreters:
The additional PHP interpreters available through KeyHelp will receive an update as quickly as I can manage. If PHP publishes the release at 14:00 UTC and the download servers withstand the rush from all over the world, you can expect the release around 16:00 UTC (18:00 CEST).

With KeyHelp’s default settings, these updates are installed in the early morning hours (05:00–07:00), so if they are released during the course of today, they will be installed tomorrow morning.
To install the updates immediately, go to “Maintenance intervals → Update PHP interpreters” or run the command “keyhelp run php-update”.


Patched PHP versions:
The following versions include the patch. As soon as these versions are running on your server, you are safe.
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
If older PHP versions are in use, the server remains vulnerable through them!


EOL operating systems:
Operating systems that have reached their end of life no longer receive updates, including PHP updates.
Older operating systems (Debian 11 and older, Ubuntu 20 and older) must be upgraded to a newer version in order to continue receiving PHP updates. (Guide: https://www.keyweb.de/en/support/learn- ... s-upgrades)

[BasHeijermans]

I already updated as the patch is released.

[jannisgo]

Hi, got some problem: I successfully installed the new PHP versions; but the System interpreter still is on 8.3.6.
How can I change it?

[Alexander]

This is expected behavior for the system default PHP version, as they are pinned to a certain version by the OS manufactures.
The OS-manufacture will supply security fixes. So looking at the patch level is more appropriate.

Please check

Code: Select all

apt-cache policy php8.3-cli

It should look like this and you will be fine.

Code: Select all

root@dev16:~# apt-cache policy php8.3-cli
php8.3-cli:
  Installiert:           8.3.6-0ubuntu0.24.04.13
  Installationskandidat: 8.3.6-0ubuntu0.24.04.13

[amarc]

If I understand: panel itself is using 'default' PHP from distro ? So apt update && apt upgrade ? Every other version update via PHP interpreters ? I am confused because even tho I updated today I still see panel is using 8.2.34.. Maybe this is just Debian numbering/version thing ?