Since Wednesday, the number one priority at SiteHost has been patching servers against two critical vulnerabilities in PHP. It was a situation where every hour counted, and for older versions of PHP, more and more of those hours stacked up.
If you were following our status updates yesterday, you would have seen that supported versions of PHP (8.2-8.5) were patched before 7:30am. Those patches were supplied by PHP. From then on we began backporting patches to older, unsupported versions. This work was not straightforward. It was late afternoon before we added 7.4-8.1 to the list. And it wasn’t until after 10pm that we had made updated, patched Cloud Container images available for PHP 5.6-7.3. That’s 15 hours after the first patching was completed.
In a world where vulnerabilities can be exploited within minutes of their disclosure, 15 hours is a very, very long time. But whenever you are relying on patches to be backported to unsupported software, a wait like this is the best-case scenario. In the future you might find that backporting is not even an option.
Updated Cloud Container images go back as far as PHP 5.6
If you are running Apache, Nginx, or WordPress Cloud Container images with any version of PHP from 5.6 up, there is a patched version of that image available.
For managed Cloud Containers, we have updated the image for you.
For unmanaged Cloud Containers, we recommend that you log in and manually update your images as soon as possible. You’ll see an ‘NV’ tag (new version) alongside each image that has an update waiting. In a few days’ time we will make the update for you, but it’s not a good idea to wait.
If you would rather not be worrying about manual image updates over a long weekend, talk to us about Server Management.
If you have built your own custom images on top of any of these images, you can update the base version of the image, then rebuild, update, and test.
For everyone, the best advice is to treat these backported patches as a temporary solution and get onto PHP 8.2+ (i.e. a supported version) as soon as possible.
Updating to a patched version of an old image will protect you against critical PHP vulnerabilities, but it may also introduce some breaking changes. Please test your websites. These changes are a consequence of backporting—and a sign that running out-of-date PHP is bound to cause problems at some stage. Backported patches replace big problems like the possibility of PHP2Shell exploits with smaller ones like:
Some libraries may behave differently.
Some extensions (e.g. GDBM) are no longer available.
For Apache servers we have removed
mpm_preforkand introducedmpm_event. We had to make an across-the-board call one way or the other, and if you still needmpm_preforkyou can switch back.
The patched container images run a newer version of Linux (24.04 LTS vs 20.04 LTS) and they compile PHP on OpenSSL v3, not v1.1 as before. These are major, unavoidable upgrades that have caused issues in the past. These issues are less of a problem than a PHP2Shell exploit would be.
Reverse deprecation is a perverse situation
Images with unsupported PHP are usually all deprecated in the Control Panel. To make updates possible, we have temporarily reversed this deprecation. This enables updating, but also provisioning. Obviously no-one should be provisioning fresh containers with PHP 5, so we will close this window next week. When we do we will enforce image upgrades for unmanaged customers.
Again, the best advice is to make your own upgrades now, and to test your websites after doing so.
Unsupported software is a bigger risk than ever, so please don't rely on backporting
This crisis is a good time to note that unsupported PHP is widespread. Thousands of Cloud Containers are in this picture, which is not good. Running old software is going to cause problems sooner or later and these days you should expect more problems sooner. Vulnerabilities are easier to find and faster to exploit than ever.
Even though backporting of these particular patches was possible, the next emergency might not play out in the same way. Future Linux upgrades, for example, could make it much harder or perhaps impossible to backport to such old versions of PHP. Much better to update to a supported version before then.
As always, we will keep working to keep your hosting and infrastructure patched and secure. If you’d like any advice on getting away from old versions of PHP, or any other security concerns, let’s talk.