PHP published a major security vulnerability yesterday. It’s a big enough security concern that basically all php everywhere needs to be updated. Naturally, I spent some time figuring out what could be updated.
I checked the software I’m self-hosting in docker containers, and only two used PHP; FreshRSS and SpeedTestTracker. I stopped both containers. FreshRSS got a fix, and I was able to update it yesterday evening. SpeedTestTracker has a patch now too, which I’ve installed.
Most of my websites are static, and I keep any sites that use PHP(like my guestbook) as a separate web service. I self-host on a Synology NAS, and yesterday Synology hadn’t put out an updated PHP package with the fix, so I just uninstalled them.
Today I see that Synology has updated the affected packages, so I’ve reinstalled them with the new versions.
Combined with news of the compromised eMudhra Intermediate Certificates(we have a problem), it was an exciting day.