Brief Security Outage

PHP recently had a Major Security CVE that they issued a patch for today, during which there was a brief interim where the vulnerability was unavailable for patching while the Ubuntu servers loaded the new packages. Thus, I took the site down for the moment while prepping the updates.

Thankfully it's easy enough to run commands. Unfortunately if I were not available it could represent a serious threat to my site were I not able to patch it myself. I may need to figure out a way to build some admin kill switch from my phone or something that kills fpm or something. I am not a fan of the new "we found arbitrary code execution faults in your PHP version" trends that have been occurring.

Wanna just thank the PHP team and maintainers for issuing the patch, providing appropriate notification, and a clear directive for this one. From what I understand attackers could gain fpm worker user access to the command line of the website through an OOM fault before the request ever reached application code. Literally a nightmare. Thank you to the many PHP maintainers and contributors, your work is greatly appreciated.