P
Paul
Guest
- #1
Thread Owner:
Paul
This is a PHP problem, not a phpBB problem
Two critical vulnerabilities in PHP itself, known together as PHP2Shell, allow unauthenticated remote code execution on any server that runs PHP. The flaws are in the PHP interpreter, the software your web server uses to run phpBB and every other PHP application. phpBB's own code is not affected, there is no phpBB security release for this, and updating phpBB will not help. The fix has to be applied to PHP on the server.
Because every phpBB board runs on PHP, every board is exposed until the server's PHP is updated. The same applies to WordPress, Drupal, Laravel and every other PHP application on the same server.
The PHP team released fixes today, 21 October 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. See the PHP security advisory for the full details (CVE-2026-109618 and CVE-2026-109619).
What you need to do
If you manage your own server: update PHP to one of the fixed versions above as soon as possible. Linux distributions received the patches in advance, so check your package manager for updates and restart PHP-FPM or your web server afterwards.
If you use a hosting provider: contact them today and ask whether the PHP version on your account has been patched for PHP2Shell. Do not assume it has been done.
If you are on PHP 8.1 or older: the PHP project no longer publishes fixes for those versions. Ask your distribution or host whether they provide a backported fix, and otherwise upgrade to a supported PHP version.
If you cannot update yet: consider taking your site offline until you can. Servers running mod_php are at the highest risk, as the exploit can be triggered before any application code runs.
Do not wait for a phpBB update. There will not be one for this issue, because phpBB is not where the vulnerability is.
You can check your current PHP version in the Administration Control Panel under System > PHP information .
What we did
We took www.phpbb.com and our other sites offline as a precaution while we waited for the patches from our hosting provider. The main site is back; the remaining sites will follow as they are updated.
If you need help, ask in the support forum or on our Discord server .
Continue reading...
Two critical vulnerabilities in PHP itself, known together as PHP2Shell, allow unauthenticated remote code execution on any server that runs PHP. The flaws are in the PHP interpreter, the software your web server uses to run phpBB and every other PHP application. phpBB's own code is not affected, there is no phpBB security release for this, and updating phpBB will not help. The fix has to be applied to PHP on the server.
Because every phpBB board runs on PHP, every board is exposed until the server's PHP is updated. The same applies to WordPress, Drupal, Laravel and every other PHP application on the same server.
The PHP team released fixes today, 21 October 2026, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. See the PHP security advisory for the full details (CVE-2026-109618 and CVE-2026-109619).
What you need to do
If you manage your own server: update PHP to one of the fixed versions above as soon as possible. Linux distributions received the patches in advance, so check your package manager for updates and restart PHP-FPM or your web server afterwards.
If you use a hosting provider: contact them today and ask whether the PHP version on your account has been patched for PHP2Shell. Do not assume it has been done.
If you are on PHP 8.1 or older: the PHP project no longer publishes fixes for those versions. Ask your distribution or host whether they provide a backported fix, and otherwise upgrade to a supported PHP version.
If you cannot update yet: consider taking your site offline until you can. Servers running mod_php are at the highest risk, as the exploit can be triggered before any application code runs.
Do not wait for a phpBB update. There will not be one for this issue, because phpBB is not where the vulnerability is.
You can check your current PHP version in the Administration Control Panel under System > PHP information .
What we did
We took www.phpbb.com and our other sites offline as a precaution while we waited for the patches from our hosting provider. The main site is back; the remaining sites will follow as they are updated.
If you need help, ask in the support forum or on our Discord server .
Continue reading...
