A critical security issue has been discovered affecting PHP versions dating back to PHP 5.4. These vulnerabilities can allow attackers to execute arbitrary commands on affected servers without authentication.
If you are running an unpatched version of PHP, you must upgrade immediately. If you are running PHP 8.1 or earlier, you should move to a supported, patched version. The minimum officially supported PHP version containing these fixes is PHP 8.2.35. PHP 8.3.36, 8.4.27 and 8.5.12 are also patched.
Please see the official PHP security advisory for more information, including temporary mitigations if you cannot upgrade immediately. These mitigations do not provide complete protection.
All XenForo Cloud installations have already been patched. You can check whether your installation has been updated by looking at the "Server environment report" block on the Admin control panel index.
Once your XenForo Cloud installation is running PHP 8.3.36, it is protected against these vulnerabilities. This is in addition to some earlier, potentially partial mitigations we deployed earlier today.
tl;dr: This is potentially one of the most serious security issues PHP has ever faced. Working exploits are publicly available, and you should upgrade immediately. No ifs, no buts. Get upgraded today to the latest patched PHP version your environment can support.
If you are running an unpatched version of PHP, you must upgrade immediately. If you are running PHP 8.1 or earlier, you should move to a supported, patched version. The minimum officially supported PHP version containing these fixes is PHP 8.2.35. PHP 8.3.36, 8.4.27 and 8.5.12 are also patched.
Please see the official PHP security advisory for more information, including temporary mitigations if you cannot upgrade immediately. These mitigations do not provide complete protection.
All XenForo Cloud installations have already been patched. You can check whether your installation has been updated by looking at the "Server environment report" block on the Admin control panel index.
Once your XenForo Cloud installation is running PHP 8.3.36, it is protected against these vulnerabilities. This is in addition to some earlier, potentially partial mitigations we deployed earlier today.
tl;dr: This is potentially one of the most serious security issues PHP has ever faced. Working exploits are publicly available, and you should upgrade immediately. No ifs, no buts. Get upgraded today to the latest patched PHP version your environment can support.
Last edited by a moderator: