Today at 14:00 UTC PHP will disclose 2 critical vulnerabilities that allow RCE (remote code execution). It is known that all PHP versions are affected, and after the disclosure there will be many attacks. It is critical to update PHP as soon as the vulnerabilities are disclosed.
The major issue is that we don't known which PHP versions will be patched. KVS now officially supports PHP 8.1, and its security updates period ended. If your projects are running on PHP 8.1, there is big chance it won't get update at all. However if your project has open source code available, you can use PHP up to 8.3 without any issues.
What to do:
ALL PROJECTS:
- Make sure your KVS projects are updated to 7.0.2 TODAY.
OPEN SOURCE CODE PROJECTS:
- If your projects have open source code, make sure your projects are running PHP 8.3 TODAY.
- Make sure your PHP gets updated as soon as the patch is disclosed.
ENCODED SOURCE CODE PROJECTS:
- Consider purchasing open source code and installing it with updating to PHP 8.3 TODAY.
- Otherwise make sure you are running PHP 8.1 TODAY. There is some chance that all PHP 8.x versions will get the patch, as the impact will be huge.
- We are preparing emergency KVS 7.0.3 update for projects with encoded source code and will be uploading them today, that will support both PHP 8.1 and 8.3 and will allow you to update to PHP 8.3 after installing the update.
- Make sure to download and install 7.0.3 update today before 14:00 UTC.
- Make sure your PHP gets updated as soon as the patch is disclosed.