Upcoming Critical PHP Security Release

jaden

Heads up for anyone running PHP - two serious vulnerabilities are being addressed in a release scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

In the meantime, the alleged temporary mitigation is to add this to php.ini

session.upload_progress.enabled = Off

https://news.ycombinator.com/item?id=50172041
https://lowendtalk.com/discussion/222337/upcoming-critical-php-security-release

ascicode

There are so many vulns comming by weekly or daily basis, that makes it boring. Its somehow all expected, because security standards rised and most tools where made 20 or more years ago and they never thinked of any hacks or leaks, because the tools only made its job.

dbadude

Php again. Whats wrong with this language?

yoursunny

PHP-based billing panels:

• WHMCS
• Blesta
• HostBill
• BillingServ
• ClientExec
• FOSSBilling

What hackers can do:

• leak customer data — GDPR lawsuits
• charge stored cards (although money goes to you) — chargebacks
• call hypervisor API (see below)

PHP-based hypervisor panels:

• SolusVM 1.x
• Virtualizor
• VirtFusion
• Tenantos
• Convoy

What hackers can do:

• delete VPS — angry tickets from and refunds for managed clients, drama threads from unmanaged clients
• create VPS — mine monero, send spam — your IP listed on Spamhaus
• do naughty inside the VPS (see below)

PHP-based shared hosting panels:

• Plesk
• ISPConfig
• Froxlor

What hackers can do:

• delete files, deface website, wipe databases — angry tickets from and refunds for managed clients, drama threads from unmanaged clients

These panels are not PHP based:

• Billing: BILLmanager (C++)
• Hypervisor: Proxmox VE (Perl), SolusIO (Go), OpenStack (Python)
• Shared hosting: cPanel (Perl), DirectAdmin (C++), aaPanel (Python)

You can escape PHP vulnerabilities, but they can have their own vulnerabilities.

Research performed by Muse.ai, "what hackers can do" written by the flesh.

davide

They are ramming the gates:

 # egrep -o 'GET [^ ]+\.php' access.log | sort | uniq -c | sort -hr
 51 GET /phpinfo.php
 42 GET /info.php
 37 GET /test.php
 37 GET /php.php
 19 GET /i.php
 17 GET /cart.php
 15 GET /wp-config.php
  7 GET /php-info.php
  7 GET /index.php
  5 GET /www/phpinfo.php
  5 GET /wp-login.php
  5 GET /wp-admin/phpinfo.php
  5 GET /tmp/phpinfo.php
  5 GET /test/phpinfo.php
  5 GET /site/phpinfo.php
  5 GET /server-status.php
  5 GET /server-info.php
  5 GET /public/phpinfo.php
  5 GET /public_html/phpinfo.php
  5 GET /p.php
  5 GET /pi.php
  5 GET /pinfo.php
  5 GET /phpversion.php
  5 GET /old_phpinfo.php
  5 GET /old/phpinfo.php
  5 GET /includes/phpinfo.php
  5 GET /htdocs/phpinfo.php
  5 GET /docs/phpinfo.php
  5 GET /dev/phpinfo.php
  5 GET /debug.php
  5 GET /admin/phpinfo.php
  5 GET /administrator/phpinfo.php
  4 GET /server.php
  4 GET /php_info.php
  4 GET /phpinfo1.php
  4 GET /infophp.php
  4 GET /api/phpinfo.php
  3 GET /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /webroot/index.php
  3 GET /webmail/phpinfo.php
  3 GET /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /vendor/phpunit/Util/PHP/eval-stdin.php
  3 GET /vendor/phpunit/src/Util/PHP/eval-stdin.php
  3 GET /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php

dbadude

@davide said:
They are ramming the gates:

 # egrep -o 'GET [^ ]+\.php' access.log | sort | uniq -c | sort -hr
 51 GET /phpinfo.php
 42 GET /info.php

The bots are very interested in your phpinfo.

ascicode

Whats next, html?

cservers

Cloudflare has put some mitigations in-place in the meantime on whichever goes through their WAF.

We've had to put 3 of our websites in maintenance. EagleKey (the VPS management portal we're developing) didn't need that, because it doesn't use PHP at all.

AnthonySmith

TierHive website, blog and control panel have been taken down as a precaution.

I am hoping the CF WAF rules and the suggested mitigation (which LES has in place) are enough for LES.

Let's hope the patching is smooth because I am in hospital tomorrow.

rockinmusicgv

Updates are live, but repos are unable to handle the load. Crazy thing about the vulns is it impacts PHP itself, regardless of the script running on top of it. Gonna be a fun day.

No config mitigation for one. The other has this:

For installations that cannot update, setting and enforcing memory_limit=-1 administratively is the primary configuration mitigation.

AnthonySmith

LES is now patched.

xyphos10

damn what a morning to wake up to. Debian has the update live and mailcow released a patch a couple minutes ago

WSS

I think this is the first time I have seen a Devuan patch that didn't take 6 months downstream of Debian.

yoursunny

@dbadude said:

@davide said:
They are ramming the gates:

 # egrep -o 'GET [^ ]+\.php' access.log | sort | uniq -c | sort -hr
 51 GET /phpinfo.php
 42 GET /info.php

The bots are very interested in your phpinfo.

Our phpinfo requires payment.
https://yoursunny.com/phpinfo.php

AnthonySmith

@yoursunny said:

@dbadude said:

@davide said:
They are ramming the gates:

 # egrep -o 'GET [^ ]+\.php' access.log | sort | uniq -c | sort -hr
 51 GET /phpinfo.php
 42 GET /info.php

The bots are very interested in your phpinfo.

Our phpinfo requires payment.
https://yoursunny.com/phpinfo.php

Unable to pay; sorry, because of a poor choice of image host, adding the domain to the Imgur anti-European blacklist:

cservers

C-Servers is now patched PHP-wise for the WebStore, Support and the Corporate websites.

We've also taken the same window to update the dedicated servers (one by one) with the other patch for PwnEscape, since most regular Internet usage/services would be down anyway with these PHP issues. 8 out of 9 are up now, Alpha1 had issues but got immediately escalated and acknowledged.

davide

@AnthonySmith said:

@yoursunny said:

@dbadude said:

@davide said:
They are ramming the gates:

 # egrep -o 'GET [^ ]+\.php' access.log | sort | uniq -c | sort -hr
 51 GET /phpinfo.php
 42 GET /info.php

The bots are very interested in your phpinfo.

Our phpinfo requires payment.
https://yoursunny.com/phpinfo.php

Unable to pay; sorry, because of a poor choice of image host, adding the domain to the Imgur anti-European blacklist:

It's blocked only in the UK, not Europe. Works perfectly from redneck farmville Italy. For the record, it also works perfectly from Kosovo, Montenegro and Transnistria, and any other European place. Come on suck it :)

AnthonySmith

@davide said:

@AnthonySmith said:

@yoursunny said:

@dbadude said:

@davide said:
They are ramming the gates:

 # egrep -o 'GET [^ ]+\.php' access.log | sort | uniq -c | sort -hr
 51 GET /phpinfo.php
 42 GET /info.php

The bots are very interested in your phpinfo.

Our phpinfo requires payment.
https://yoursunny.com/phpinfo.php

Unable to pay; sorry, because of a poor choice of image host, adding the domain to the Imgur anti-European blacklist:

It's blocked only in the UK, not Europe. Works perfectly from redneck farmville Italy. For the record, it also works perfectly from Kosovo, Montenegro and Transnistria, and any other European place. Come on suck it :)

Still a higher percentage of blocked countries than there is ipv6 users

WSS

@AnthonySmith said: Still a higher percentage of blocked countries than there is ipv6 users

yoursunny

@AnthonySmith said:

@yoursunny said:

@dbadude said:

@davide said:
They are ramming the gates:

 # egrep -o 'GET [^ ]+\.php' access.log | sort | uniq -c | sort -hr
 51 GET /phpinfo.php
 42 GET /info.php

The bots are very interested in your phpinfo.

Our phpinfo requires payment.
https://yoursunny.com/phpinfo.php

Unable to pay; sorry, because of a poor choice of image host, adding the domain to the Imgur anti-European blacklist:

The image was uploaded by @FAT32 in 2020-Dec.

jarland

That was a fun day. Fleet fragmentation prevented easy deployment, so the only fleet wide deployment was the disabling of PHP app access to then begin the patching.

imok

4 servers upgraded to bookworm and patched. I didn't know I had so many outdated servers.

dbadude

trying two POC's for this php flaw on my servers, they all fail. Is there a POC that works?

david3

This stuff gets added to an ipset block list with a 3 day timeout.

cat -v /home/blah/logs/blah.blah/error.log | grep '"Primary script unknown"' | grep -E -o "([0-9]{1,3}[.]){3}[0-9]{1,3}" | sort | uniq >> ${AUTHFAILURES}
cat -v /home/blah/logs/blah.blah/error.log | grep 'access forbidden by rule' | grep -E -o "([0-9]{1,3}[.]){3}[0-9]{1,3}" | sort | uniq >> ${AUTHFAILURES}

Neoon

@david3 said:
This stuff gets added to an ipset block list with a 3 day timeout.

cat -v /home/blah/logs/blah.blah/error.log | grep '"Primary script unknown"' | grep -E -o "([0-9]{1,3}[.]){3}[0-9]{1,3}" | sort | uniq >> ${AUTHFAILURES}
cat -v /home/blah/logs/blah.blah/error.log | grep 'access forbidden by rule' | grep -E -o "([0-9]{1,3}[.]){3}[0-9]{1,3}" | sort | uniq >> ${AUTHFAILURES}

Same, the issue is, they just send 30 requests within a second, to bypass that.
The system needs like 2s to ban an IP right, add rate limits too if you not already have.

vyas

@imok said:
4 servers upgraded to bookworm and patched. I didn't know I had so many outdated servers.

Now you need to treat yourself with flan

cornercase

NPM has a remediation recommendation: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5961

Kind of seems like this was blown out of proportion though, since I don't see any exploit attempts.

treesmokah

Cloudflare started to cover these exploits with both free and paid WAF. I still wouldn't rely on it, and patch as soon as possible. But I guess you have a fallback when you use CF.
https://blog.cloudflare.com/php-vulnerabilities-waf-protection/