PHP remote code exploit vulnerability

[Canis]

I've been getting pinged on Discord by servers left and right shutting down their websites until they can patch PHP on their server. Coverage of this is blowing up right now it looks like. PHP is the backbone of like 80% of the web, so… yeah. phpBB and SMF Forums websites are both among the services currently on lockdown. edit: both of them are back up now

_{from https://en.wikipedia.org/wiki/PHP2Shell}
The vulnerability was rated 9.2 (critical) out of 10 under CVSS v4.0 by PHP developers,^[4] while security firm watchTowr rated it a full 10.0.^[5]

[Ad Bot]

[SBG]

i have NO idea what this computer jargon means, but is it still at risk of happening again?

[Conan]

no, the path that it takes to RCE web servers is patched

potentially, in that its not perfect software as most software isn't.

but if you don't host a website or work in webdev you dont really have to worry about anything besides the sites you have accounts on getting hacked, maybe. pretty much everyone in the webdev world was on this stuff right away.

[Mr Queeba]

my personal website uses php, pulled it offline yesterday morning for a couple hours until my distro released the patches
this is the biggest security vuln in history so far

[Soukuw]

Oh man I thought we were not coming back, I was gonna post this the other night and seriously regretted it not doing that before the site went down.

[Soukuw]

AI told me badspot needs to add a .htaccess to his website to remove the .php from it.

[the hacker]

Our borrowed time marches on, but it flickers.

[Foxscotch]

i just don't use php. skill difference

[Ladios]

i just don't use php.

[Conan]

ok but eating php is very different from using php. can't really compare the two like that.

[Foxscotch]

ok but eating php is very different from using php. can't really compare the two like that.

i dont eat it either. if it's php it's not for me

also what the forget did you do to my quote

[Conan]

i can hear you chewing from here :/

[Foxscotch]

i can hear you chewing from here :/

simply using a website doesn't count! that would be impossible to avoid. things you don't even know use php use php

[Ladios]

if it's php it's not for me
     use php use php

It doesn't let me bold text in the quote attribution

[Master Matthew²]

Hey, wait a second. The BLF uses PHP.
I'm sure the update is coming any second now.