- Joined
- Aug 20, 2021
- Messages
- 133
- Points
- 38
@ENXF NET you might wanna take a look at this
PHP shipped two critical RCEs today, 21 Oct 2026. Both are unauthenticated
and both hit PHP itself rather than any particular app, so anything running
PHP is in scope: PHP-FPM, mod_php, php-cgi, LiteSpeed. Risk is highest on
mod_php, where the exploit can run before any of your code does.
Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older
get nothing, they're EOL and no longer get security updates.
Xenforo posted their own announcement here:
https://xenforo.com/community/threads/police-car-light-urgent-update-your-php-immediately.240896/
Where that leaves us:
XF 2.3 runs on PHP 8.1+ and is fine on 8.2.35 / 8.3.36 / 8.4.27. Done.
XF 2.2 tops out at PHP 8.1, which is unpatched.
XF 2.1 tops out at PHP 7.4, also unpatched, and 7.4 will never get an
official fix now. For 2.1 and 2.2 the real fix is the 2.3 upgrade.
If you can't get to 2.3 today, PHP published temporary mitigations here:
https://www.php.net/archive/2026.php#2026-10-21-5
They cut off the known attack paths but they don't make you safe, so treat
them as a stopgap. For nginx with PHP-FPM the short version is: set
memory_limit=-1, post_max_size=32M and session.upload_progress.enabled=0
with php_admin_value in your pool, give the pool a systemd MemoryMax so a
runaway worker gets killed instead of the request reaching PHP's OOM
handling, and cap client_max_body_size in nginx so big bodies never reach
PHP.
Please also have a look for signs of an attacker. These bugs run code as the
web worker, so look at new or modified .php files in the web root, data,
internal_data and the attachments folder, at php-fpm spawning shells, and at
cron entries you didn't add.
Attacks are already happening, there's a public PoC in use since 17 Oct.
Please don't leave this sitting over the weekend.
PHP shipped two critical RCEs today, 21 Oct 2026. Both are unauthenticated
and both hit PHP itself rather than any particular app, so anything running
PHP is in scope: PHP-FPM, mod_php, php-cgi, LiteSpeed. Risk is highest on
mod_php, where the exploit can run before any of your code does.
Fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older
get nothing, they're EOL and no longer get security updates.
Xenforo posted their own announcement here:
https://xenforo.com/community/threads/police-car-light-urgent-update-your-php-immediately.240896/
Where that leaves us:
XF 2.3 runs on PHP 8.1+ and is fine on 8.2.35 / 8.3.36 / 8.4.27. Done.
XF 2.2 tops out at PHP 8.1, which is unpatched.
XF 2.1 tops out at PHP 7.4, also unpatched, and 7.4 will never get an
official fix now. For 2.1 and 2.2 the real fix is the 2.3 upgrade.
If you can't get to 2.3 today, PHP published temporary mitigations here:
https://www.php.net/archive/2026.php#2026-10-21-5
They cut off the known attack paths but they don't make you safe, so treat
them as a stopgap. For nginx with PHP-FPM the short version is: set
memory_limit=-1, post_max_size=32M and session.upload_progress.enabled=0
with php_admin_value in your pool, give the pool a systemd MemoryMax so a
runaway worker gets killed instead of the request reaching PHP's OOM
handling, and cap client_max_body_size in nginx so big bodies never reach
PHP.
Please also have a look for signs of an attacker. These bugs run code as the
web worker, so look at new or modified .php files in the web root, data,
internal_data and the attachments folder, at php-fpm spawning shells, and at
cron entries you didn't add.
Attacks are already happening, there's a public PoC in use since 17 Oct.
Please don't leave this sitting over the weekend.
