We have become aware of 2 serious CVEs in PHP related to multipart file uploads.
These are potentially very serious as they could allow arbitrary code execution within a website without the need for a specific CMS exploit meaning that any PHP website is potentially vulnerable.
On Enhance, websites are containerised so the scope of the RCE would be limited to the individual website unless chained with a LPE vulnerability - check and ensure your kernels are up to date.
Once php.net release a patch, we will immediately build and release Enhance PHP packages. In the meantime we have just released Enhance 12.26.1 which has 2 changes.
session.upload_progress.enabled now defaults to Off in php.ini unless specifically configured at a platform, server or website level. It is our current understanding that this provides some protection from the new vulnerabilities.
We have added a command ecp restart-php which can be run on a server to restart all PHP containers without the need to restart the system or use the API. This is useful to apply the above mitigation instantly but you can also use it once the new PHP packages are released.
To apply the update and the mitigation, run on every server:
apt update
apt upgrade -y
ecp restart-php
Please check back here regularly for updates.
