Issue Reminder to update PHP if you haven't already

[Grzesiek11]

A pair of critical PHP vulnerabilities have been released today.

PHP (first post, I can't seem to be able to link to it properly)

This 100% affects this forum if it's not been updated, and would allow for a full takeover. Since it seems to use CF, it might not be as much of an issue, because it's WAF supposedly already has some mitigations, but it's important to do it regardless.

 

[Vector]

Site with links to the CVEs and mitigation instructions: PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web

This is as bad as the Heartbleed exploit in OpenSSL a few years back.

 

[lIlI]

I'm looking for additional tech support to make sure nothing about the forum is broken as we adjust things in the backend, if you have experience with this and are able to help, let me know. Thank you to Grzesiek11 for the insight provided already!

 

[MagicalMiku]

Here's the official announcement on XenForo page:
https://xenforo.com/community/threads/police-car-light-urgent-update-your-php-immediately.240896/

Please see the official PHP security advisory for more information, including temporary mitigations if you cannot upgrade immediately. These mitigations do not provide complete protection.

All XenForo Cloud installations have already been patched. You can check whether your installation has been updated by looking at the "Server environment report" block on the Admin control panel index.

Once your XenForo Cloud installation is running PHP 8.3.36, it is protected against these vulnerabilities. This is in addition to some earlier, potentially partial mitigations we deployed earlier today.

 

[Vector]

I'm a software engineer by profession, though I usually work in enterprise Java and Go land, not PHP stuff so much (it's been awhile). I just spent the last six hours updating my personal web server though, going through several distro upgrades (I've been neglecting it lol), updating old WordPress sites and generally unbreaking things. It was...a pain.

Anyway, with that fresh in memory, I can certainly try to answer questions if there's a hangup somewhere.

Fortunately, it sounds like the fix got backported to a lot of older PHP versions by some distros, so doing painstaking OS upgrades might not be necessary. e.g. Ubuntu patched all the way back to PHP5 php2shell (CVE-2026-109618 and CVE-2026-109619) – PHP critical vulnerability fixes available | Ubuntu. Depending on whether this is running on a VPS/dedicated server or something more managed, and what OS it is, plays a large part in how big of a shift it is. (e.g. it sounds like XenForo already updated XenForo Cloud users.)

If PHP is relatively current, like another 8.x, there probably shouldn't be breaking language-level changes. It should just be a matter of confirming the update, and then following Xenforo's instructions to perform any updates for that PHP version.

 

[SeleDreams]

I myself administer a server for a small wordpress (well, classicpress) blog. and in this case since i use a VPS, i just had to log in to my ssh and use sudo apt update && sudo apt upgrade -y to update the php version without any trouble. though it of course depends on how out of date the xenforo version is and what php version it depends on.
the best is likely to do a full server backup before.