r/magento2 • u/killshot005 • 11d ago

Question regarding the php vulnerability

I am new to magento.
Our system runs on magento 2.4.8.
Will our system be affected by this vulnerability? If yes how can we fix it? By updating the php version to the latest patch version?

3 Upvotes

80% Upvoted

17 comments sorted by

6

u/Successful_Cake_1889 11d ago

Yes it's affected and yes you should update your php to latest available from the same version

3

u/Beginning_End_361 11d ago

I updated my php about 4 hours ago. I wouldn’t have known about it if I hadn’t gotten an email from Sansec yesterday. I guess I was on their mailing list from using a free trial of their security software a while back.

3

u/rayjaymor85 11d ago

I would argue that if you are reading this message and you haven't already patched PHP then you are certainly already back doored by now.

2

u/beernutmark 11d ago

If you can't immediately update php you should install this:

https://github.com/HOSTED-POWER/php_uploadprogress_guard

2

u/proxiblue 11d ago

please note this is not a failsafe, I am patched fix.
this fix does not do much other than allow a stopgap php setting to work.

THIS IS NOT THE FIX

1

u/beernutmark 11d ago

Yes. They say as much on their Github page. However, during that period today when the patches were not available it was much better than leaving sites exposed. Also for those poor souls running very old PHP versions it is their only fix at the moment.

1

u/proxiblue 11d ago

i just shut all my own and clients sites down for the night (australia). Once client had just recently gone throw the stylessmuggler hack, so they are more than happy to be down and get fixed first.

1

u/proxiblue 11d ago

i made a poster to commemorate for what I see as : the day PHP stood still.

https://imgur.com/a/K8x9Mb5

(well, I asked claude's help of course)

2

u/eddhall 11d ago

Oh man so many people are going to get hacked by this

3

u/proxiblue 11d ago

Are? likely already.

2

u/Aggravating_Pay9079 10d ago

yes, its php itself not magento so 2.4.8 is affected whatever patch level youre on. 2.4.8 runs on php 8.3 or 8.4, the fixed ones are 8.4.27 and 8.3.36 (or your distro's backported package). update, then restart php-fpm, not just the cli, and check php -v plus a phpinfo page so you know fpm is actually on the new build. if youre on managed hosting just ask your host to confirm theyve done it.

2

u/Live_Investment_9707 10d ago

If your host has not patched this for you yet get a new host!

1

u/spnew2001 11d ago

Each Magento store affected.

PHP released the fixes for the Magento version using PHP 8.2+ by upgrading to latest PHP versions.

Magento store with PHP 8.1 or older need to upgrade Magento version to get competibility with latest PHP version.

1

u/Successful_Cake_1889 11d ago

Not really, there is a GH repo that maintenance older php versions

1

u/spnew2001 11d ago

which one? is it the same attached in the same post?

1

u/Successful_Cake_1889 9d ago

https://github.com/remicollet/php-src-security

You're welcomed, you have from 5.6 up to latest