Today's script
Last night PHP sent out an emergency notice. Two critical vulnerabilities are being patched today. The PHP team rated both 9.2 out of 10. The patch comes out today at 14:00 UTC (5 pm in Türkiye). The details leaked online yesterday. According to Sansec, mass attacks could start within 15 minutes of the patch. According to Sansec, PHP 5.4 and later are affected. 8.1 and older won't get an official patch. I checked my own server. The sites run on PHP 8.4 and 8.5. The real surprise: on 8.4 I had already missed 3 security patches. First I installed the patches that were already out. Then I temporarily turned off upload progress. If you use Cloudflare, add a WAF rule too. It should block requests that carry this field. But that alone isn't enough. Cloudflare only looks at the start of the request body. If your server can be reached directly by its IP address, the attacker never meets Cloudflare. There's only one real fix: install today's release. I'm updating again at 5 pm. If you're on hosting, write to your provider today. Send this video to someone who runs a site.
