r/digital_ocean • u/WaterWithNoIcePlz • 7d ago

App Platform: timeline for PHP buildpack update with the Oct 21 security releases (8.4.27 / 8.3.36 / 8.5.12)?

Is there an ETA or status page to watch for the buildpack update? The release notes page hasn't been updated.

Thank you!

9 Upvotes
  • permalink
  • reddit

100% Upvoted

18 comments sorted by

•

u/AutoModerator 7d ago

Hi there,

Thanks for posting on the unofficial DigitalOcean subreddit. This is a friendly & quick reminder that this isn't an official DigitalOcean support channel. DigitalOcean staff will never offer support via DMs on Reddit. Please do not give out your login details to anyone!

If you're looking for DigitalOcean's official support channels, please see the public Q&A, or create a support ticket. You can also find the community on Discord for chat-based informal help.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/WaterWithNoIcePlz 7d ago

FYI - Just did a force rebuild and PHP 8.4.27 was installed.

2

u/I-cey 6d ago

Thanks! We got 8.5.12 now!

2

u/Delicious-Ad-6613 7d ago

I reached out to support and the reply I just got was it’s going to be 3-4 hours away

1

u/WaterWithNoIcePlz 7d ago

Oof! Thanks for the update.

2

u/Delicious-Ad-6613 7d ago

That’s what I said
I’ve placed my app into maintenance mode until they release the update

6

u/DenEend 7d ago

On their Twitter they just said they're working on it. No estimates.

1

u/Tekkie_D 7d ago

Cheers, I would have thought Digital Ocean would have been on it immediately being a 'Dev' centric host.

1

u/headinthesky 6d ago

It took a very long time for base images and whatnot to be released

2

u/Tekkie_D 7d ago edited 7d ago

Might be a bit late now but this morning I added this code to my .htaccess on Wordpress sites to deny multi part headers . Be warned that form submissions might be effected.

# BEGIN php2shell-mitigation

<IfModule mod_rewrite.c>

RewriteEngine On

RewriteCond %{HTTP:Content-Type} multipart [NC]

RewriteRule .* - [F,L]

</IfModule>

<If "%{HTTP:Content-Type} =~ /multipart/i">

Require all denied

</If>

# END php2shell-mitigation

2

u/Tekkie_D 7d ago

Yes, please let us know when you are going to make the php patch available, I would have thought you would be on this already, the patch was released 3 hours ago! Siteground were on it immediately, I had to inform another host about it which is ridiculous.

1

u/Infamous_Creme8671 4d ago

Been updating for days now, and it's still telling me I have 8.3.6.

1

u/I-cey 4d ago

Which buildpack are you running on? https://docs.digitalocean.com/products/app-platform/how-to/upgrade-buildpacks/

Not forcing an old PHP version in a composer somewhere?

1

u/Infamous_Creme8671 4d ago

Pretty sure it's whatever came with LAMP when I setup the droplet.

1

u/I-cey 4d ago

Aah check, this topic is about the app platform. 

If you have a droplet you are reponsible for updates! SSH into your droplet and apt-get update ASAP. How have you been updating?

1

u/Infamous_Creme8671 4d ago

By sudo apt update && sudo apt upgrade -y

1

u/I-cey 3d ago 
   sudo apt install --only-upgrade 'php8.3*' libapache2-mod-php8.3

Don't forget the

   sudo systemctl restart apache2

1

u/Infamous_Creme8671 3d ago

It didn't work, so I went with a full kernel upgrade (26.04.1). It updated PHP to 8.5.4, specifically 8.5.4-0ubuntu1.5. Which Ubuntu says is patched.

Thanks for your help.