Selfhosted

63151 readers

1370 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

297

PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC) (arstechnica.com)

submitted 2 days ago* (last edited 1 day ago) by BlackEco@lemmy.blackeco.com to c/selfhosted@lemmy.world

52 comments fedilink hide all child comments

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

you are viewing a single comment's thread
view the rest of the comments

[–] fubarx@lemmy.world 67 points 2 days ago (2 children)

"I felt a great disturbance in the Force, as if millions of Wordpress sites suddenly cried out in terror and were suddenly silenced."

[–] hereiamagain@sh.itjust.works 11 points 1 day ago (2 children)

Seriously though, how quickly do you expect patches to be available for WordPress? I've got one WordPress site that I made years ago for a friend's business. I pop in on it and update stuff every few months.

Should I take it down?

[–] MouldyCat@feddit.uk 19 points 1 day ago* (last edited 1 day ago) (1 children)

it's PHP that needs the patches. Yes you should take the site down until PHP has been patched.

edit: assuming you are hosting wordpress yourself. if you're using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.

[–] hereiamagain@sh.itjust.works 5 points 1 day ago

Yeah it's self hosted, thanks

[–] GreenKnight23@lemmy.world 4 points 1 day ago* (last edited 1 day ago) (1 children)

Should I take it down?

depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don't take proper backups)?

[–] hereiamagain@sh.itjust.works 2 points 20 hours ago

How dare you (correctly) assume I haven't taken proper backups!

Jk lol

I do have a couple backups I made a few months ago. Never tested restoring them, so I don't count them as "real".

I'm hosting on namecheap servers, using their cpanel and stuff. So I don't have the option of installing my own PHP version, just selecting theirs.

But apparently they had some mitigations in place before updating, and then they got us updated.

[–] rozodru@piefed.world 3 points 1 day ago

it's a lot more than wordpress...