Issue Reminder to update PHP if you haven't already

[Grzesiek11]

A pair of critical PHP vulnerabilities have been released today.

PHP (first post, I can't seem to be able to link to it properly)

This 100% affects this forum if it's not been updated, and would allow for a full takeover. Since it seems to use CF, it might not be as much of an issue, because it's WAF supposedly already has some mitigations, but it's important to do it regardless.

 

[Vector]

Site with links to the CVEs and mitigation instructions: PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

This is as bad as the Heartbleed exploit in OpenSSL a few years back.

 

[lIlI]

I'm looking for additional tech support to make sure nothing about the forum is broken as we adjust things in the backend, if you have experience with this and are able to help, let me know. Thank you to Grzesiek11 for the insight provided already!

 

[MagicalMiku]

Here's the official announcement on XenForo page:
https://xenforo.com/community/threads/police-car-light-urgent-update-your-php-immediately.240896/

Please see the official PHP security advisory for more information, including temporary mitigations if you cannot upgrade immediately. These mitigations do not provide complete protection.

All XenForo Cloud installations have already been patched. You can check whether your installation has been updated by looking at the "Server environment report" block on the Admin control panel index.

Once your XenForo Cloud installation is running PHP 8.3.36, it is protected against these vulnerabilities. This is in addition to some earlier, potentially partial mitigations we deployed earlier today.