PHP Vulnerability CVSS v4.0 9.2.

[hfoster]

FYI. Big PHP vulnerability pretty much in the wild. Seems to be related to file uploads, so potentially affects FusionPBX when users can upload recordings, etc. There's a lot of conjecture about mitigation (e.g, people saying you can disable: session.upload_progress.enabled, etc) but nothing concrete: Upcoming Critical PHP Security Release. Looks like it has the moniker: php2shell.

I suspect the fix will be to simply update the PHP packages when it drops.

 

[henryd99]

Best thing to do is restrict port 80/443 to only VPN/Whitelisted IPs till you patch.
I might be wrong, but possibly any one running EOL versions (>=8.1) will not have the patch available.
I know a lot of people are running EOL PHP versions alongside old Fusionpbx versions also.

 

[trumee]

Would be nice if FusionPBX migrated to a modern framework.

 

[hfoster]

Wouldn't really be FusionPBX then, it would just be something else. I've burned a number of tokens having a pop at a FreeSWITCH phone system in Rust, and it really is quite a lot of plumbing that needs doing.

Regardless, this particular exploit was irrespective of the framework, and considering the other nonsense today like the node CVEs, Railway getting compromised, Gitlab CVEs, etc. It seems nowhere is safe from the wandering eyes of the almighty AI.