PHP security alert

[alan_sh]

How does this affect WWB sites?

https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o

Alan

[BaconFries]

Only if they have implemented the likes of forms, login tools, admin tools, cms tools. It also effects where it is hosted
Apache/Nginx whether what version of php it is running from php5 to php8 and has it been patched or not. If it isn't using any php and primarily just using static html, css, javascript then it shouldn't be any issue.

Not sure how it will effect sites made with the software but have implemented php forms or scripts from the likes of php jabbers or others which use php so you should check with them. Alan currently Pablo is on a short break but I am sure he will give his answer on this himself.

[AliGW]

My host, IONOS, is installing security fixes over the next 24 hours, so presumably my PHP logins and forms created with WWB will remain secure.

[BaconFries]

so presumably my PHP logins and forms created with WWB will remain secure.

The threat itself won't directly target or even corrupt it but where it is hosted could be affected if not patched to fix the following "PHP2Shell" crisis (CVE-2026-109618 & CVE-2026-109619). As you have mentioned your host is acting on this to patch over the next 24hrs but and I say but maybe untill they have patched you could temporarily take down for peace of mind. Note this is not related to the php code itself but of the php version on the server.

[AliGW]

Thanks, I have alerted the users of the website and asked them not to submit online entry forms until the fix has been implemented. I'll keep an eye on IONOS' messages for now.

[brimanHTML]

I was able to patch my 2 VPS's running Rocky Linux 10.x Yesterday
Between the kernel updates and other services it is a daily routine for me to check for updates

[alan_sh]

I've just updated my web servers (Synology NAS). It was easy - Synology released updates to 8.1,8.2.8.3 and 8.4. My only issue was one server still running 7.4 that a backup program was using, but I updated the O/S and that sorted that one out.

[Pablo]

How does this affect WWB sites?

These vulnerabilities do not specifically affect WYSIWYG Web Builder (WWB) websites. They affect the PHP software running on web servers, regardless of which website builder was used.

If a server runs a vulnerable version of PHP, attackers may be able to execute malicious code remotely without logging in or knowing any passwords.

This means that even a WWB website with no PHP functionality of its own could potentially be affected if the hosting server runs a vulnerable PHP installation.

The solution is to ensure that the hosting provider updates PHP to a patched version. Updating WWB itself will not fix these PHP vulnerabilities.

[alan_sh]

Thank you

Alan