On the 23rd of October the forum Admin already posted the following in
the Forum Moderation thread
---
Hi, folks.
As you are all likely aware, a serious PHP vulnerability was
published a yesterday (Pacific time) and there are active exploits
being launched at essentially the entire public internet. The last
information I read, a few hours ago, indicated that there are
millions of the exploits running now. Most government websites in
the US were down for much of yesterday as folks scrambled to patch
their PHP installs.
Unfortunately, the forum is running PHP 7.4, and with the older
version of Joomla that we're running, it cannot be upgraded. Because
it is so old, there is no binary patch available at this time. I'm
looking into a couple options that don't involved shutting down the
forum until we can build a new one with more modern software, which
would be a prolonged outage if not planned ahead of time, but I
don't have a solution yet.
I did make some changes to the PHP configuration on the forum site
that PHP.net say will help mitigate exploit attempts, but that's at
best a band-aid.
I hope to have a short term solution soon. There is a version of
PHP7.4 now that is not vulnerable, but it has to be hand-compiled.
That may be almost trivial, and it may be very difficult - I'm not
sure with the old development tools on our forum. That is one
possible solution, and there may be another that I'm just starting
to check into.
Long term, of course, is to upgrade everything. It's looking less
possible now to do that in situ than I thought at first.
At any rate, it should be less vulnerable now, and I'll keep you
posted as I make further progress.
Cheers!
--Stephen
---
https://forum.linuxcnc.org/moderator-forum/59346-php-vulnerability#350493
this is the link, but not everyone here can probably see it, since it
requires mod permissions.
so I have created a new discussion, you only need to be a member of the
forum to reply here
https://forum.linuxcnc.org/36-using-this-forum-questions/59359-forum-upgrade-discussion
I believe things are already under control, but the discussion about the
forum should move to the forum, as the admin there is not subscribed
here, and asked on IRC to move the discussion to the forum, please if
you have more to say, post on the forum.
---
Luca
_______________________________________________
Emc-developers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/emc-developers
