Emergency upgrades for PHP

If you’re reading this, your website (or at least your open-source CRM) runs on PHP, so this matters:

“Security advisory: Critical remote code execution vulnerabilities, update now”

The PHP project has released an update to fix two critical vulnerabilities that can allow unauthenticated remote code execution. The project urges, “All PHP users are strongly encouraged to update immediately.”

Am I protected?

If you’re hosting with Joinery: we’re on it. All our servers are being upgraded to the latest PHP security release as I write this.

If you’re not hosting with Joinery, you’ll need to inquire with your hosting provider. Probably they’re on it. Probably worth asking.

Who’s affected?

If you’re reading this, you are. So is any site running WordPress, Drupal, Joomla, Backdrop, or any of a hundred other genuinely fabulous packages that rely on PHP.

What’s the potential impact?

Significant.

“Remote code execution” means an attacker could run their own code on your server.
“Unauthenticated” means they would not need to log in first.

Should I panic?

No. That never helps.

But it’s wise to inquire with your hosting provider. They’re busy handling this (one hopes), but they probably won’t mind telling you so if you ask.

And if they’re not handling it, please shoot me a quick reply here, as I’ll be glad to discuss options with you. (Sure, Joinery hosting is an option, but there are other options too.)

All the best,
A.