php2shell CVE notes

Internet now is full of this CVE about PHP upgrades, and I’m just putting up a couple of links which I found very useful for those who are not able to switch to newer PHP.

I am myself in the same situation. I have projects running down to PHP 5.2. Those I am most likely putting under password protection, since those are mostly internal ones. Where I can, of course, I do migration, at least to PHP 8.2, but there are quite a few where I had PHP compiled manually, so these patches and tweaks definitely help. We do pray on those who made them.

Thank you, guys, you are awesome.

Huge thank you, and huge credits go to Mr. Ondřej Surý. Man, without you, we would be fucked. I cannot express gratitude we all have and express towards your work. Thank you once again.

https://github.com/Anton-Barinov/php2shell-patches – repository with PHP patches for various old versions. Patch your source code, compile it, install. Yes, the good, the old way.

https://github.com/syhunt/php2shell-protection – quite a decent explanation about the issue and about the approaches to how we can eliminate or minimize risk until we can upgrade or find another solution. Very good, very well explained, very well written, and understandable.

If you have any other good news or any good tips, or need help, feel free to contact me. Hope we all are safe and healthy.