302
submitted 3 days ago* (last edited 3 days ago) by BlackEco@lemmy.blackeco.com to c/selfhosted@lemmy.world

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

you are viewing a single comment's thread
view the rest of the comments
[-] hereiamagain@sh.itjust.works 12 points 3 days ago

Seriously though, how quickly do you expect patches to be available for WordPress? I've got one WordPress site that I made years ago for a friend's business. I pop in on it and update stuff every few months.

Should I take it down?

[-] MouldyCat@feddit.uk 20 points 3 days ago* (last edited 3 days ago)

it's PHP that needs the patches. Yes you should take the site down until PHP has been patched.

edit: assuming you are hosting wordpress yourself. if you're using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.

[-] hereiamagain@sh.itjust.works 5 points 3 days ago

Yeah it's self hosted, thanks

[-] GreenKnight23@lemmy.world 4 points 2 days ago* (last edited 2 days ago)

Should I take it down?

depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don't take proper backups)?

[-] hereiamagain@sh.itjust.works 2 points 2 days ago

How dare you (correctly) assume I haven't taken proper backups!

Jk lol

I do have a couple backups I made a few months ago. Never tested restoring them, so I don't count them as "real".

I'm hosting on namecheap servers, using their cpanel and stuff. So I don't have the option of installing my own PHP version, just selecting theirs.

But apparently they had some mitigations in place before updating, and then they got us updated.

this post was submitted on 21 Oct 2026
302 points (99.3% liked)

Selfhosted

63189 readers
650 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS