Question

Any fix for PHP Remote Code Execution vulnerability?

Posted April 9, 2018 2.1k views
Ubuntu PHP

I came across the recent exposure of a major remote code execution vulnerability in PHP:
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-023/

I am running a server with PHP 5.5.9 (Ubuntu 14.04) and it’s not clear to me how to upgrade it to something higher than 5.6.34 to keep myself protected.

Can anyone with droplets on D.O who has patched their server (s) recently, offer any suggestions? As far as I have seen, running apt-get upgrade doesn’t seem to offer the version of PHP that’s more secure (can’t upgrade to PHP 7.0 on a production server.

Thanks in advance.

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

1 answer

When looking to patch a vulnerability using official packages it should be noted that distributions like Ubuntu backport fixes to previous versions rather than pushing updates on their LTS releases. For this reason the version number alone cannot be used to determine if your PHP package is vulnerable. Ubuntu 14.04 has not reached EOL and should make a patch available for it’s current PHP version which backports this fix.

  • Thanks, that’s helpful. One doubt, though - until the patch becomes available, wouldn’t the server be left unprotected?

    Also, is there somewhere I can track when Ubuntu 14.04 will make this patch available?

Submit an Answer