I'm sure all my PHP peeps have heard about the two critical (9.2) CVEs in the language released yesterday. If not, you'll want to update. They affect all previous versions back to PHP 5. Sounds like a great many admins had to deal with it, with some even shutting down sites while waiting. I have updated the servers I was able, but have some that cannot, and have had to settle for mitigation.
I've seen suggestions that the CVEs are hard to attack unless the server has certain pre-existing vulnerabilities in their code. Current publicly available exploits seem to require this vector. However, some people who may be more in the know seem to suggest that there are other, easier ways to attack it. So its best to update ASAP where possible, and mitigate when not possible.
I saw notice of the impending CVE release on social media on Tuesday, so I was forewarned that I'd be needing to deal with it yesterday. I took snapshots of all important servers running PHP before the release just in case. My up to date servers got the updates within a couple hours after the release and everything went smoothly. I rebooted to be sure.
But some of the servers at work are old, having old sites that would not be easy to update to work on new PHP / MySQL versions, and clients unwilling to pay for it. So I did my best to mitigate the issue on those. Most of the sites are behind Cloudflare, which added new firewall rules to block requests targeting these CSVs. The firewall also has a rate limiting rule set up that should slow any attempts. Based on the PHP team's recommendation, I set session.upload_progress.enabled = 0 in php.ini. Other PHP settings that we already had in place were low limits on upload size. I will have to see what else I can do to help limit risk.
Eventually, I will have to try to update the sites that I can to work on newer PHP and MySQL versions, but the company is much smaller than it used to be and I think that will take a long time. So far I haven't seen any signs of successful attacks on these servers, or even attempts getting through Cloudflare. But I will have to keep an eye on them. I have seen an increase in general bot probing, looking for signs of certain CMSs or files placed in webroot that shouldn't be.
On my personal server, which is not behind Cloudflare, I did see some attempts. There were errors in the server logs like Missing boundary in multipart/form-data POST data and Input variable nesting level exceeded, a few hundred of them so far. Since that server is updated, this shouldn't be a problem other than if they really go at it, they can easily overwhelm it.
The PHP Foundation released a post about the related development security situation of the project. I appreciate their efforts. PHP is still probably my favorite programming language and I will continue to use it.