302
submitted 3 days ago* (last edited 3 days ago) by BlackEco@lemmy.blackeco.com to c/selfhosted@lemmy.world

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

you are viewing a single comment's thread
view the rest of the comments
[-] fubarx@lemmy.world 68 points 3 days ago

"I felt a great disturbance in the Force, as if millions of Wordpress sites suddenly cried out in terror and were suddenly silenced."

[-] hereiamagain@sh.itjust.works 12 points 3 days ago

Seriously though, how quickly do you expect patches to be available for WordPress? I've got one WordPress site that I made years ago for a friend's business. I pop in on it and update stuff every few months.

Should I take it down?

[-] MouldyCat@feddit.uk 20 points 3 days ago* (last edited 3 days ago)

it's PHP that needs the patches. Yes you should take the site down until PHP has been patched.

edit: assuming you are hosting wordpress yourself. if you're using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.

[-] hereiamagain@sh.itjust.works 5 points 3 days ago

Yeah it's self hosted, thanks

[-] GreenKnight23@lemmy.world 4 points 2 days ago* (last edited 2 days ago)

Should I take it down?

depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don't take proper backups)?

[-] hereiamagain@sh.itjust.works 2 points 2 days ago

How dare you (correctly) assume I haven't taken proper backups!

Jk lol

I do have a couple backups I made a few months ago. Never tested restoring them, so I don't count them as "real".

I'm hosting on namecheap servers, using their cpanel and stuff. So I don't have the option of installing my own PHP version, just selecting theirs.

But apparently they had some mitigations in place before updating, and then they got us updated.

[-] rozodru@piefed.world 3 points 3 days ago

it's a lot more than wordpress...

this post was submitted on 21 Oct 2026
302 points (99.3% liked)

Selfhosted

63158 readers
736 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS