Question
Any fix for PHP Remote Code Execution vulnerability?
I came across the recent exposure of a major remote code execution vulnerability in PHP: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-023/
I am running a server with PHP 5.5.9 (Ubuntu 14.04) and it’s not clear to me how to upgrade it to something higher than 5.6.34 to keep myself protected.
Can anyone with droplets on D.O who has patched their server (s) recently, offer any suggestions? As far as I have seen, running apt-get upgrade doesn’t seem to offer the version of PHP that’s more secure (can’t upgrade to PHP 7.0 on a production server.
Thanks in advance.
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
When looking to patch a vulnerability using official packages it should be noted that distributions like Ubuntu backport fixes to previous versions rather than pushing updates on their LTS releases. For this reason the version number alone cannot be used to determine if your PHP package is vulnerable. Ubuntu 14.04 has not reached EOL and should make a patch available for it’s current PHP version which backports this fix.