Critical PHP CVE Mitigation

We have automatically updated all projects that can be updated from our side. We'll reach out to the owners of those that remain.

Thanks for your patience while we worked through getting everyone patched!

Backported patches for PHP 7.4, 8.0 and 8.1 have been created and we plan to roll these out to projects today. Once complete, we will be in contact with the owners of any projects that have not been able to be updated for any reason with further steps to take. At that time we will also close off this incident.

We are currently rolling out updates to all eligible projects that have not yet manually updated. We are expecting this to be completed within the next few hours. We are also working on backporting the patches for projects using PHP 7.4, 8.0 and 8.1. We are hoping to roll out those updated tomorrow.

Some projects are not currently able to be updated due to a loss of connection between Servd and the project's git repo - we will be emailing the owners of these projects once we have completed updates for other projects.

We are beginning to automatically rebuild deployed bundles for all unpatched project environments running PHP 8.2 or higher, replacing them with builds running a safe version of PHP. However, the quickest and safest means to secure your projects is to rebuild your deployed bundles manually as soon as you can.

We've also just published a post regarding this incident in our blog https://servd.host/blog/mitigation-of-critical-php-cves We'll be keeping it updated with additional information as it becomes available.

We've now released patched PHP versions for 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Please proceed to build and sync new bundles to all your environments. When a safe bundle is deployed to an environment, our platform will automatically disable the multipart upload block. If you need assistance doing so, please reach out to us via support@servd.host.

For projects running PHP 8.1 or lower, we recommend updating your sites to PHP 8.2 or higher as soon as possible. For these projects, the multipart upload block will remain in place for the foreseeable future but will be automatically lifted when a safe bundle is deployed.

The official PHP docker images have completed publishing, we're now in the process of making new PHP versions available.

Patched official PHP images have been published, but we're not yet seeing any exported image layers to them. This is blocking our efforts to release patched PHP versions to Servd. We're regularly monitoring for changes.

The patched official PHP docker images have been published. We'll have patched PHP versions available shortly.

We're currently blocked on releasing patched PHP versions, due to delays in the release of the official PHP docker images. We'll be exporting base bundles as soon as they're made available.

We've received details of the vulnerability and are awaiting official patched PHP images. As soon as they're available, we'll be publishing new base bundles, and allowing customers to deploy them to their environments.

In the meantime, we're shoring up our defensive edge rules based on the released info.

We are currently waiting for PHP to release fixes which is due at 14:00 UTC. At this time we will prep them for use in Servd projects which we are expecting to take 20-30 minutes.

Once these have been confirmed as effective at mitigating the issue we will release them for all projects. We will update this status page once they have been released.

Once released - any new bundles created in our dashboard which are using PHP 8.2 + will contain the fix. Deploying these will automatically re-enable multipart requests for your project.

This timeline may change in two scenarios:

1. PHP do not release their updates on time or it is delayed for another reason
2. The fixes within the PHP releases do not actually address the attack we have been seeing today (there has been no official confirmation that the two are related, but there is a very strong likelihood that they are the same thing).

Due to the PHP critical vulnerability due to be disclosed today we have blocked all multipart upload requests on all projects and on servd.host.

This will create 403 errors for image and other file uploads. We are working on restoring normal functionality, however due to the critical nature and trivial exploitation of the bug, this is the safest course of action for the time being.