An urgent message about vigilance and swift action in the cyber realm. Two critical vulnerabilities in PHP, the language behind a large share of the world's websites, need attention today.
Two dangerous flaws have been disclosed in the PHP runtime. Both are rated critical and both call for immediate action from anyone who runs PHP in production.
Attackers move fast once a flaw is public. Every hour between disclosure and patch is an hour a site can be scanned, probed and compromised.
Including sites built on WordPress, Laravel, Drupal and other PHP platforms.
Follow the official changelog on php.net for your version branch.
Oversight bodies keep monitoring and sharing updates as the situation develops.
Work through them top to bottom. Step three applies only if you cannot patch right away.
Confirm whether your servers run PHP and which version. Run php -v on the host, or check your hosting control panel. Do not forget staging servers and forgotten side projects.
Install the security release for your PHP branch through your package manager, container image or host. Restart PHP-FPM or your web server so the new binary is actually running.
If the update cannot be applied immediately, temporarily disable or take down the website. A short outage costs far less than a breach, stolen data or a defaced homepage.
Follow updates from official cybersecurity bodies, watch your logs for unusual requests, and pass the warning on to other admins. Security is a shared network.
A walk-through of what patching looks like on a typical Debian or Ubuntu server. Package names differ on other systems.
php -vShow the running PHP versionsudo apt update && sudo apt upgrade php*Install the latest PHP packagessudo systemctl restart php*-fpmLoad the patched binaryEvery patch is a beam of blue light over a crack in the shield. Together, technicians and web administrators keep the global internet standing.
The world's servers and code, bound together in one network.
The layer of protection that surrounds the whole ecosystem.
Red points where unpatched systems leave the shield open.
Blue light that seals each gap, one quick update at a time.