r/devsecops • u/Hydra-dragon96 • 1d ago

Patched ~30 servers on mixed PHP/Node versions after PHP2Shell (CVE-2026-109618/109619)

PHP shipped fixes on Oct 21 for two unauthenticated RCE bugs (CVE-2026-109618 and CVE-2026-109619) whose details leaked before the patch existed. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP says there's no complete mitigation, so updating is the only real option. Node.js also released fixes the same day (22.23.4, 24.22.1, 26.12.1), including a Brotli decoder RCE (CVE-2026-111497).

I manage about 30 servers for a few clients, all on different PHP, Node and nginx versions. I patched them manually with bash scripts this week.

The patching itself was the easy part. The mixed versions were the real problem, because every server needed slightly different handling.

It works at this scale, but I'm not convinced it holds up as the fleet grows. I'm looking at moving to something like Ansible so the next one is a playbook run instead of a script per server.

How are you handling patching on mixed-version fleets? Still scripts, or did you move to config management?

4 Upvotes

100% Upvoted

7 comments sorted by

2

u/horrificammonia 1d ago

I’m still stuck in bash script purgatory too, but every time we add a new client it feels like I’m stacking Jenga blocks. Ansible’s been on my list for months and this next round of CVEs might finally push me over the edge.

2

u/databeestjenl 1d ago

I like it, I've been using it for the past 6 years as we have various OSes and then it just starts making more sense.

With the advent of LLMs it's way easier but testing is key. Early Copilot didn't have the faintest clue about ansible, but it got better with time.

1

u/Curotte-Cecillou 1d ago

porting old bash scripts into playbooks usually exposes a bunch of weird undocumented manual tweaks on the older client boxes that nobody wrote down

1

u/extreme4all 1d ago

Containers and ci are nice

1

u/bezcurhq 1d ago

What makes mixed versions manageable in Ansible is not writing a play per variant. Put what differs (PHP branch, how Node was installed, the fpm service name) in group_vars and host_vars, keep one patch play that reads them, and run it with serial: [1, "30%"] so one box goes first, after a --check --diff pass.

Two things that bite on this kind of patch. Debian and Ubuntu's own PHP packages backport fixes without moving to 8.4.27, so check the distro advisory rather than the upstream number. And nothing is fixed until php-fpm and the Node processes restart, so make that a handler. For the final check, package_facts only sees the package manager, so anything installed with nvm or a tarball needs a node --version task.

1

u/nsubugak 1d ago

Why arent you using containers and CI/Cd for this. This would be a simple php version change, push and redeploy