PHP Vulnerability CVSS v4.0 9.2.

[hfoster]

FYI. Big PHP vulnerability pretty much in the wild. Seems to be related to file uploads, so potentially affects FusionPBX when users can upload recordings, etc. There's a lot of conjecture about mitigation (e.g, people saying you can disable: session.upload_progress.enabled, etc) but nothing concrete: Upcoming Critical PHP Security Release. Looks like it has the moniker: php2shell.

I suspect the fix will be to simply update the PHP packages when it drops.

 

[henryd99]

Best thing to do is restrict port 80/443 to only VPN/Whitelisted IPs till you patch.
I might be wrong, but possibly any one running EOL versions (>=8.1) will not have the patch available.
I know a lot of people are running EOL PHP versions alongside old Fusionpbx versions also.