Question

Any fix for PHP Remote Code Execution vulnerability?

I came across the recent exposure of a major remote code execution vulnerability in PHP: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-023/

I am running a server with PHP 5.5.9 (Ubuntu 14.04) and it’s not clear to me how to upgrade it to something higher than 5.6.34 to keep myself protected.

Can anyone with droplets on D.O who has patched their server (s) recently, offer any suggestions? As far as I have seen, running apt-get upgrade doesn’t seem to offer the version of PHP that’s more secure (can’t upgrade to PHP 7.0 on a production server.

Thanks in advance.


Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Ryan Quinn
DigitalOcean Employee
DigitalOcean Employee badge
April 9, 2018
Accepted Answer

When looking to patch a vulnerability using official packages it should be noted that distributions like Ubuntu backport fixes to previous versions rather than pushing updates on their LTS releases. For this reason the version number alone cannot be used to determine if your PHP package is vulnerable. Ubuntu 14.04 has not reached EOL and should make a patch available for it’s current PHP version which backports this fix.

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Featured on Community

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more