Login
You're viewing the mastodonapp.uk public feed.
  • James BaillieJubalBarca@scholar.social
    Oct 21, 2026, 3:40 PM

    Right, I'm finally at a desk, I am sleep deprived and have just travelled halfway across the continent: people dealing with this #PHP shit, what should those of us who aren't sysadmin types but are running PHP sites on shared hosting from big vendors do?

    I'm seeing a lot of "take your website offline" but that's not actually very helpful without clarification - does that mean "put it into maintenance mode" or "scrub everything off the server" or somewhere in between?

    💬 7🔄 10⭐ 0

Replies

  • Gina Peter BanyardGirgias@phpc.social
    Oct 21, 2026, 3:49 PM

    @JubalBarca Your hosting company should be the ones dealing with it, and they might already have. Check if they have a support page/press release about it.

    💬 1🔄 0⭐ 0
  • James BaillieJubalBarca@scholar.social
    Oct 21, 2026, 3:53 PM

    @Girgias I checked that before making this post, I wasn't going to pass on the chance to *not* have to faff around with this. But there's nothing on their status page and AFAICT the servers are still running unpatched versions.

    💬 1🔄 0⭐ 0
  • Gina Peter BanyardGirgias@phpc.social
    Oct 21, 2026, 3:59 PM

    @JubalBarca well that _is_ annoying. Opening a support ticket might be the simple option, but if you can park the site in maintenance mode that's probably better.

    💬 0🔄 0⭐ 0
  • Miamia@hcommons.social
    Oct 21, 2026, 3:51 PM

    @JubalBarca I wish I knew! I've just checked the support pages and announcements on my personal host and there's nothing about updating the PHP version

    💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • 💬 1🔄 0⭐ 0
  • James BaillieJubalBarca@scholar.social
    Oct 21, 2026, 4:47 PM

    @mia Have now had an email from mine saying they're rolling out the patches and they actually think some aspect of their particular server system stopped the vulnerability being useable anyway. So that's good. I'll reopen all the websites tomorrow probably assuming they've rolled out the patches by then.

    💬 0🔄 0⭐ 0
  • Taeltael@yiff.life
    Oct 21, 2026, 3:54 PM

    @JubalBarca Seconding maintenance mode. Take any web-accessible PHP offline until you are certain you're patched. Static pages only.

    💬 0🔄 0⭐ 0
  • James BaillieJubalBarca@scholar.social
    Oct 21, 2026, 4:00 PM

    @tael For some of what I'm doing there's an easy maintenance mode option... for others I guess I might just have to do something like rename public_html and leave the whole website giving a 404 error in the meantime? I can't think of a better quick way to make some of the messier sites properly inaccessible.

    💬 1🔄 0⭐ 0
  • Taeltael@yiff.life
    Oct 21, 2026, 4:03 PM

    @JubalBarca A temporary 404 is better than a compromised shell, I guess. You could maybe edit the apache/nginx files to return a 503 instead.

    💬 0🔄 0⭐ 0
  • James BaillieJubalBarca@scholar.social
    Oct 21, 2026, 4:05 PM

    @tael Yeah I'm just trying to work out what I can do reasonably fast: I do not have time or spoon to work out how to do anything fancy across however many websites/subdomain-websites I'm trying to work through (double figures and they basically all use PHP).

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Rich Puchalsky ⩜⃝richpuchalsky@mastodon.social
    Oct 21, 2026, 4:33 PM

    @JubalBarca

    Someone who knows a lot more than I do said to disable mod_php (presumably in Apache). I put a ticket in with my hosting company but they haven't yet actually done anything.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0