I don't like waking up to a possible internet collapse...
There seems to be two critical RCE vulnerabilities discovered in PHP.
If you are using HortusFox, please make sure it's not accessible from the public Internet. I will monitor the situation and see if I have to take any action when the security patches are live.
Ars TechnicaPHP warns it plans to release 2 emergency patches imminentlyUnconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
As a measurement of caution, all my websites have now been turned offline until further notice.
I'm currently communicating with my hoster on how fast they can apply a patch when released.
For HortusFox users, this means your workspace cannot check for new updates, or share images with the hortusfox.com backend.
All my platforms will be back online as soon as the situation is resolved.
You know things get serious when even the german Tagesschau publishes news on the subject:
https://www.tagesschau.de/wirtschaft/technologie/it-sicherheit-php-luecke-100.html
Meanwhile, the PHP Group published the fixes:
https://github.com/php/php-src/releases/tag/php-8.5.12
tagesschau.deProgrammiersprache PHP: Sicherheitslücke bedroht weltweit WebseitenZahlreiche Webseiten und Onlinedienste weltweit sind derzeit in Gefahr: Grund ist eine Sicherheitslücke in der weitverbreiteten Programmiersprache PHP. Das Gefahrenpotenzial ist demnach extrem hoch.
