You're viewing the social.telemetrydeck.com public feed.

Federated feed Local feed

Veronica Explainsveronica@explains.social
Oct 21, 2026, 1:57 PM
In your shell, if you hit php -v and it lists a number other than:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
...then you should consider yourself vulnerable and update immediately.
If a new version of php is not available, you should consider taking your stuff down until you get updated packages. There are incomplete mitigations listed on https://www.php.net.
This is especially important for folks using popular "set it and forget it" tools like YunoHost, cPanel, or Plesk, or big PHP projects like Nextcloud or WordPress.
And if you aren't the admin, go bug your IT folks about this. Just mention "php2shell" and see if that lights a fire under them.
EDIT: don't forget to restart after updating, also check the docs for whatever you're serving to see how to check the served PHP version and make sure you're up to date.
💬 2🔄 2⭐ 0

Replies

Buttered Jortsajn142@infosec.exchange
Oct 21, 2026, 2:34 PM
@veronica there's a recommendation to prefer the served version of PHP to the php -v command line argument, because old PHP processes can keep running if you don't forcibly restart them. But frequently the version isn't included in the header response. Probably the easiest solution is "after you verify the version via CLI, just restart"
💬 0🔄 0⭐ 0
Veronica Explainsveronica@explains.social
Oct 21, 2026, 2:35 PM
@ajn142 Completely agreed.
💬 0🔄 0⭐ 0
William Wittemanwillyyam@mastodon.social
Oct 21, 2026, 2:35 PM
@veronica sorry for asking, but do you know how to force the upgrade in Debian?
I have a machine on Trixie that has received the update, but my Forky machine has not.
💬 0🔄 0⭐ 0
Veronica Explainsveronica@explains.social
Oct 21, 2026, 2:36 PM
@willyyam Forky is testing, you probably won't get the update for some time. That's the downside of running testing, it's delayed.
💬 1🔄 0⭐ 0
William Wittemanwillyyam@mastodon.social
Oct 21, 2026, 2:53 PM
@veronica thank you.
Also, boo :-(
Do you have recommendations for documentation for moving from "testing" to "stable"?
💬 0🔄 0⭐ 0
Veronica Explainsveronica@explains.social
Oct 21, 2026, 2:54 PM
@willyyam you really can't. This is a reason not to run testing.
If you're tracking by the release name ("forky" instead of "testing"), your install will become stable only when Forky is released. Until then, it's testing.
💬 0🔄 0⭐ 0