Critical PHP updates

And now hearing that the patch doesn't completely fix the issue.

Or maybe it's a different similar exploit. Hearing that PHP 8.5.12 is vulnerable.
 
Error: Failed to download metadata for repo 'epel': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried
executing 'dnf --quiet --assumeyes install gcc-c++ make autoconf pkgconfig openssl-devel systemd-devel krb5-devel libcurl-devel libpng-devel freetype-devel libwebp-devel libjpeg-devel libxslt-devel libsodium-devel libicu-devel sqlite-devel oniguruma-devel libffi-devel libtool-ltdl-devel libzip-devel' failed (attempt 1/3)
Error: Failed to download metadata for repo 'epel': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried
executing 'dnf --quiet --assumeyes install gcc-c++ make autoconf pkgconfig openssl-devel systemd-devel krb5-devel libcurl-devel libpng-devel freetype-devel libwebp-devel libjpeg-devel libxslt-devel libsodium-devel libicu-devel sqlite-devel oniguruma-devel libffi-devel libtool-ltdl-devel libzip-devel' failed (attempt 2/3)

It's legacy license
 
Scan your logs

Code: 
zgrep -hiE 'php2shell|109618|109619' \
/var/log/nginx/domains/*.log* \
/var/log/httpd/domains/*.log* 2>/dev/null

Code: 
zgrep -hiE 'auto_prepend_file|php://input|allow_url_include' \
/var/log/nginx/domains/*.log* \
/var/log/httpd/domains/*.log* 2>/dev/null
 
exlhost said:
Scan your logs

Code: 
zgrep -hiE 'php2shell|109618|109619' \
/var/log/nginx/domains/*.log* \
/var/log/httpd/domains/*.log* 2>/dev/null

Code: 
zgrep -hiE 'auto_prepend_file|php://input|allow_url_include' \
/var/log/nginx/domains/*.log* \
/var/log/httpd/domains/*.log* 2>/dev/null
Click to expand...
Thanks, what should I do now.
149.102.239.83 - - [21/Oct/2026:14:27:52 +0200] "GET / HTTP/1.1" 301 4861 "-" "php2shell-checker/3.0 (authorized-scan)"
149.102.239.83 - - [21/Oct/2026:14:27:52 +0200] "GET / HTTP/1.1" 200 46619 "-" "php2shell-checker/3.0 (authorized-scan)"
149.102.239.83 - - [21/Oct/2026:14:27:53 +0200] "POST / HTTP/1.1" 200 46852 "-" "php2shell-checker/3.0 (authorized-scan)"
213.152.161.54 - - [21/Oct/2026:13:34:50 +0200] "HEAD / HTTP/1.1" 200 4832 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 php2shell-probe"
213.152.161.54 - - [21/Oct/2026:13:45:35 +0200] "POST / HTTP/1.1" 200 99124 "-" "Mozilla/5.0 php2shell-sidfix"
 
exlhost said:
I don't want to be rude, but seriously, CentOS 7 is so outdated that you could do already an in-place upgrade to Almalinux.
Click to expand...
You're absolutely right, and I completely agree. However, these servers won't be in use much longer, so upgrading the OS isn't really worth the time and effort.

I'm just looking for a temporary way to keep PHP patched and secure in the meantime.
 
I have been able to compile a patched version of php7.4 on almalinux servers but not on centos7 servers, it just downloads the latest php7.4 without the patch. Any suggestions on how to get this patached on centos7?
 
exlhost said:
We have heard that it has not been fully patched. Does anyone have more information on whether this is real and correct?, see below.

fedi.katze.sh

Elise (@[email protected])

Attached: 1 image still works on 8.5.12!
fedi.katze.sh fedi.katze.sh
Click to expand...
Looks like a separate memory bug, not yet fixed, that a specific PHP function triggers when a script calls it in a certain way. It isn't shown to be reachable through a simple web request.
 
fln said:
A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.
Click to expand...
Are you planning any updates or patches for CentOS 7.9? Many of us are still running it with DirectAdmin, and it would be helpful to know if any compatibility fixes or security updates are planned.
 
Thanks for the quick work DA team, now updating the last few things...
(Should also be said, in my opinion...)
 
fln said:
A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.
Click to expand...

GREAT WORK! Really appreciated! :-D
DirectAdmin > Plesk!
 
You must log in or register to reply here.
Back
Top