Changelog
What has changed on this site
When a new advisory lands, a fact changes or a page is added, it is recorded here with the date, newest first. Each page also shows the date it was last checked against its sources.
-
Can't patch, and a risk score
- A new page for systems that cannot be updated yet: six mitigating controls, and how to accept the remaining risk properly
- The risk calculator now gives a score out of 100 with a Critical, High, Medium or Low rating, asks about the mitigating controls already in place, and takes the PHP version from a list
- The operator's name corrected to CyPro Consulting Ltd throughout
-
First edition
- PHP2Shell explained, with fixed versions for every branch and the 23 and 26 October follow-up advisories
- A dated PHP2Shell timeline, from the researchers' report on 24 August to CISA's catalogue listing on 26 October
- A risk calculator for deciding whether a site should stay online, following the NCSC's priority actions
- Update guides for hosting plans, cPanel, Plesk, Windows, Docker, PHP-FPM, Apache, LiteSpeed, Ubuntu, Debian, the RHEL family, CloudLinux and Amazon Linux
- PHP version requirements for nine platforms, from Magento to Nextcloud
- Release pages for 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and route-by-route upgrade guides
- Facts confirmed at source: Red Hat, AlmaLinux and Rocky Linux errata; cPanel's and Plesk's backports into PHP 7.4, 8.0 and 8.1; CISA's catalogue listing; Moodle HQ's precautionary takedown
Spotted something out of date? Tell us and we will check it against the source.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.