In a statement, an Elections B.C. spokesperson said the website was temporarily shut down to allow for system maintenance after a “global security vulnerability” was identified. It was restored as of 3:20 p.m. PT.
Good for them! Any PHP-based service facing the Internet that isn’t patched in the next 12 hours or so will likely be taken over by bots by tomorrow. Mirai already has a php2shell module and is blasting across the Internet. PHP5 and PHP6 are vulnerable and have no patches.
How can I independently verify that my hosting provider has updated their PHP services that are used to serve my web site?
It’s a fairly generic Softaculous/Cpanel based host.
And, yes, I have sent an email request. Still waiting (and waiting) for a reply.
You can add a phpinfo file to check the version:
<?php phpinfo(); ?>
That should give you the details to check the version running matches the patched versions. Just remove it when your done for maximum obfuscation.
Yep, I updated my public facing nextcloud as soon as I could too.
Ondrej’s repository has a php 5.6 fix for ubuntu if you can’t get any official backport yourself.
