Critical PHP CVE Mitigation

Patched official PHP images have been published, but we're not yet seeing any exported image layers to them. This is blocking our efforts to release patched PHP versions to Servd. We're regularly monitoring for changes.

The patched official PHP docker images have been published. We'll have patched PHP versions available shortly.

We're currently blocked on releasing patched PHP versions, due to delays in the release of the official PHP docker images. We'll be exporting base bundles as soon as they're made available.

We've received details of the vulnerability and are awaiting official patched PHP images. As soon as they're available, we'll be publishing new base bundles, and allowing customers to deploy them to their environments.

In the meantime, we're shoring up our defensive edge rules based on the released info.

We are currently waiting for PHP to release fixes which is due at 14:00 UTC. At this time we will prep them for use in Servd projects which we are expecting to take 20-30 minutes.

Once these have been confirmed as effective at mitigating the issue we will release them for all projects. We will update this status page once they have been released.

Once released - any new bundles created in our dashboard which are using PHP 8.2 + will contain the fix. Deploying these will automatically re-enable multipart requests for your project.

This timeline may change in two scenarios:

1. PHP do not release their updates on time or it is delayed for another reason
2. The fixes within the PHP releases do not actually address the attack we have been seeing today (there has been no official confirmation that the two are related, but there is a very strong likelihood that they are the same thing).

Due to the PHP critical vulnerability due to be disclosed today we have blocked all multipart upload requests on all projects and on servd.host.

This will create 403 errors for image and other file uploads. We are working on restoring normal functionality, however due to the critical nature and trivial exploitation of the bug, this is the safest course of action for the time being.