how do you handle the new php security issue?

[PeterPan]

https://www.php.net/archive/2026.php#2026-10-20-1

 

https://www.heise.de/news/Wichtige-PHP-Updates-am-21-Oktober-beheben-Codeeinschleusung-Schwachstellen-11495072.html

 

 

Edited October 21 by PeterPan

[the.rampage.rado]

As far as I read the info online, just update with today's update for your PHP version and everything should be fine.

Already online: https://github.com/php/php-src/releases

[Yabber]

49 minutes ago, the.rampage.rado said:

s far as I read the info online, just update with today's update for your PHP version and everything should be fine.

Installing the PHP patch causes very serious problems in Thirtybees. It is not possible to save ANY data in the back office.  The problem occurs with both PHP 8.1 and PHP 8.3

[wakabayashi]

2 hours ago, Yabber said:

Installing the PHP patch causes very serious problems in Thirtybees. It is not possible to save ANY data in the back office.  The problem occurs with both PHP 8.1 and PHP 8.3

Why? As far as I understand this are just minor updates. Of course they are very crucial, but if you stay on your main version, you should be fine or not?

[Yabber]

7 hours ago, wakabayashi said:

Why? As far as I understand this are just minor updates. Of course they are very crucial, but if you stay on your main version, you should be fine or not?

I apologise for the incorrect information.
My hosting provider, which runs servers on FreeBSD, somehow applied this PHP patch incorrectly yesterday, and as a result, data saving in Thirtybees within the back office wasn’t working across all PHP versions.
They’ve now fixed the issue and everything is working fine today. 🙂

 

[the.rampage.rado]

Nice to know. Waiting for hosting.com to propagate the fix to my server. 

[DRMasterChief]

I just wanted to mention that our fantastic hosting provider was working from yesterday afternoon until after 2 a.m. today, constantly updating their website.

They had already disabled a PHP function beforehand and informed us about it (the file upload issue), which was the first important security measure.

We were kept informed live about which PHP versions had been updated and when everything was working again. They worked through the night, and all functions are available again.

I find it a bit alarming, however, that such a large hosting provider as hosting.com has no information on their site and apparently hasn't implemented any fixes even today?  edit: i can see in their Blog that they have updated PHP also since a few hours.

In short: we can't detect any problems with ThirtyBees after the PHP fixes. Everything is fine.

Edited October 22 by DRMasterChief

[Yabber]

The PHP team has only released patches for the currently supported versions of PHP.
By contrast, the teams responsible for Linux and Unix distributions, such as FreeBSD, have released patches for all versions of PHP from 5.6 onwards.
Yesterday, there was a PHP update in Debian; all versions of PHP were updated.
In FreeBSD, too, all versions of PHP were updated.

[the.rampage.rado]

Yesterday my hosting supplier updated my server.

In the meantime, I noticed an unsuccessful attempt on my layered module. Will investigate if the code in this section is shared between it and the thirty bees version.