PHP Vulnerabilities - Tip Of The Iceberg?

[newcustomeroffer]

I'm sure you're all on top of the PHP situation that's been all over the news in the past 24 hours. If you're not up to speed then there's details here: https://www.ncsc.gov.uk/news/critica...-affecting-php

I get the feeling though that we're just at the very start of this and AI is going to be finding vulnerabilities at an alarming rate as we move forward. The era of perpetual fire-fighting and patching could be upon us. Stay safe everyone.

[universal4]

They did not publish a single version number which is the wrong way to talk about a vulnerability although they did link to the answer.

Answers for that here
https://www.php.net/index.php

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

I hope cpanel and cwp make sure the fixes and updates work.

Rick
Universal4

[universal4]

To add, it does look like the latest version of CWP (control web panel) does support the higher versions of php, at least until php 8.5.9

/edited to add CWP version 1.20 does already support up to php 8.59 (although I feel better about updating all the linux libraries just in case you have not updated CWP in a month or more)

This will allow the selector on a per site basis and how cwp gets it together to allow the root (or main) php to be updated as well.

Have not had a chance to double check cpanel yet. Guessing they either have already or will have updates in place shortly.

I have put feelers out with a few other tech's as I know this is something that a number of members will want to monitor.

Rick
Universal4

[universal4]

A few guys have asked me to update when possible.

What I have found so far is that CWP version 1.20 does not allow for the patched versions of php.
After yum update/dnf update etc updating all the libraries etc cwp does not update by itself. (tried with both AlmaLinux 8 and 9)

Not sure of the outcome of having auto updates turned on for cwp itself, I usually keep that turned off so it doesn't accidentally break anything without a backup etc.

You can however force the upgrade of cwp with a shell script and after that, quick reboot and sure enough the 8.5.12 was available and am rebuilding one php build now.

sh /scripts/update_cwp

After this is done with a reboot your cwp should be on 1.21 and allow for the higher php versions.

Keep in mind you might want the cgi and the fpm versions built so you can then change each site independently depending on needs.

As a number of guys at the cwp forum said, this does not update the internal php, but at least this will take care of the php on sites, which is likely the biggest attack vector anyway.

Thanks a bunch to the guys that dropped me a mail and pushed me to read up on this more, anyone needs a hand drop me a line.

Rick
Universal4

[universal4]

OK,

Got it to run using 8.5.12 fpm version as the build usually fails without a few minor changes. (from inside the cwp panel)

Happy to help if anyone needs it, I admit it took me rebuilding php 2 or 3 times looking through the logs to figure it out.

If anyone knows whether cpanel already has this fixed, let us know thinking they will quickly.

Again, thanks for the additional input from others, in case other members need extra input.

Rick
Universal4

[newcustomeroffer]

Good work Rick. I think we all need to be prepared for significant upheaval over the next few days, weeks and months. This tweet was from the Anthropic security chief Jason Clinton overnight: https://x.com/JasonDClinton/status/2113325263157395456

as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)

[abidseo]

Thanks to Rick for pinning down the patched versions, because that detail matters more than the headline panic. For anyone running affiliate sites, the first practical step is not just to update once, but to inventory every site and confirm which PHP version is actually running on each one, not just what the control panel claims is available. I have seen cases where a panel update left an older version still serving a live site, so checking the live environment after the change is essential.

The second point is sequencing. Take a backup, test the patched version on a staging copy if you can, and watch for plugin and theme compatibility problems, especially on older WordPress builds. A rushed PHP jump that breaks a review table, a bonus feed, or a comparison layout can cost rankings and conversions just as surely as a security incident, so the update needs a quick front-end check after it goes live.

The wider point in the original post is worth taking seriously too. If AI-assisted discovery keeps accelerating, treating patching as a one-off event will not be enough. A routine check for the PHP version, the panel version, and any unpatched extensions, plus monitoring for unexpected file changes, is now part of basic site maintenance. For gambling affiliate sites in particular, a compromise does not just mean downtime: a hacked page can trigger browser warnings and search warnings, and recovering trust after that is far slower than the update itself.

[universal4]

Yes for those that are able to just go ahead and update their current 8.x versions should do so as soon as they can.

For those upgrading from 7.x versions or lower, be sure to get backups etc just in case you have an older template or plugin that causes issues.

Agree that patching and or upgrading sites, server OS and infrastructure should also be a discussion as part of long term plans.

Rick
Universal4

[bigmax]

I saw this on X and thought it was just some fear-mongering and engagement farming going on. Didn’t think for a second that it was real. Come to find out PHP powers 43 percent of the web. Sheesh

[newcustomeroffer]

There was an interesting case study yesterday to see just how easy (or hard) it is to crack the PHP vulnerability whereby someone created a vulnerable website called xxx.stealmybitcoin.com and put a $2k bounty on it for the first person to successfully hack the site.

Grok's summary of the outcome: https://x.com/grok/status/2114557812395200644

a server ran unpatched PHP 8.4.26 vulnerable to the new PHP2Shell RCEs (CVE-2026-109618/109619). A Bitcoin private key (~$500, later ~0.025 BTC/$2k via donations) sat behind a print-flag binary accessible only to the PHP user.

First to exploit and claim it won. It held for 19.28 hours until 15:47 UTC on 25 Oct 2026. Winner KillaBoi used a multi-stage memory-corruption chain (OOM session poisoning, heap/code leaks, forged structures for system()) and posted the PoC.

Suggests to me that it was pretty hard work to hack the site which likely means any exploitation of PHP will be very targeted, so the wider internet can probably sleep a little easier.

[universal4]

A portion of the problem is that tools to take advantage of any vulnerability the older versions do have will improve likely.

Additionally, those on the older versions do not necessarily need the extra bandwith and thousands of hits to the sites on the general scans etc. Although I have not seen anyone write about it yet, but wondering if the sciptkiddies will focus more on such targeted attacks. Only time will tell on that one.

Yes it is good that many of the attack vectors of the last few years are not "easy" but I think being aware of the vulnerability is helpful in the end.

Also keep in mind that a small portion of extensions have been deprecated (especially if moving from a 5x or 7x version). In some cases you need to replace the extension, in a few cases they just need to be renamed. Be sure to monitor the phperror logs close after upgrades in case your template is using a function that was changed.

Rick
Universal4

[casinobonusguy]

We managed to update our network except for 2 forums which run on older software ,we are still working their solutions for those.