PHP is scheduled to release fixes for two critical vulnerabilities today at 14:00 UTC. Both are rated CVSS 9.2. Both are reported to allow remote code execution without authentication on default PHP installs and as details leaked before the patch, exploits are already circulating.
What We’re Doing Now
We’ve disabled session.upload_progress on all servers as a temporary mitigation. Public research points to this feature as the attack path. It isn’t an official fix, but it closes the known route until patches land.
Adverse impacts of this: If your app uses PHP’s built-in upload progress tracking, progress bars may stop updating. Uploads still work. Most apps track progress in JavaScript and won’t notice.
Optional: Extra Protection with NGINX Templates
The attack needs a multipart/form-data request (the format used for file uploads). Blocking or limiting those requests at Nginx stops it before it reaches PHP.
We’ve released two Nginx config templates.
Please pick the one that fits your site:
Variant 1: Allow uploads on specific paths, block the rest. Multipart requests are only allowed on the paths you list, with a rate limit of 5 requests/minute. Edit the paths and limit to match your site before using it.
Variant 2: Block all multipart requests. For sites that never accept file uploads or multipart form submissions. Use as is.
You can find these templates here:
https://manage.runcloud.io/settings/nginx/templates/public
Before you pick Variant 2, check whether your site accepts uploads anywhere. WordPress uses multipart for media uploads, plugin/theme installs and many contact forms. If any of those apply, use Variant 1 and allow those paths (for WordPress, usually /wp-admin/async-upload.php, /wp-admin/update.php, /wp-admin/media-new.php, plus any form endpoints).
These templates apply to NGINX-based stacks only. They don’t apply to OpenLiteSpeed or LiteSpeed Enterprise.
How patches will roll out
Patches will be applied automatically to all supported PHP versions (8.2 and newer). You don’t need to do anything.
Timing depends on your stack:
- Native (NGINX / NGINX+Apache): We build our own PHP packages. We’ll build and release patched versions as soon as PHP publishes the fix.
- Docker / Containerized: These use Ondřej Surý’s PHP packages. We’ll release as soon as Ondřej publishes patched builds.
- OpenLiteSpeed / LiteSpeed Enterprise: These use LiteSpeed’s own PHP builds (lsphp). We’ll update as soon as the LiteSpeed team releases patched versions.
We’ll update this post as each stack is patched.
If you run PHP 8.1 or older
PHP 8.1 and older are end-of-life. PHP’s official fixes cover only 8.2 and newer. Assume your version will not get an official fix. RunCloud will not release patched builds for PHP 8.1 or older.
Switch your web apps to PHP 8.2 or newer before 14:00 UTC today. You can change the PHP version for each web app from the RunCloud dashboard.
Test your app after switching. Most modern WordPress and Laravel apps run fine on 8.2+. Older plugins or custom code may need updates.
The temporary mitigation stays active on older versions, but it’s not a replacement for upgrading. Don’t leave a site on end-of-life PHP once the details go public.
Recommended for Everyone
Be on PHP 8.2 or newer. That’s the only way to keep getting security fixes.
Updates
21 Oct, 8:00 UTC: Temporary mitigation applied to all servers.
21 Oct, 8:30 UTC: NGINX templates released.
21 Oct, 22:00 UTC: Patched builds released for Native and OpenLiteSpeed / LiteSpeed Enterprise. Rolling out automatically.
Native: patched build available
OpenLiteSpeed / LiteSpeed Enterprise: patched build available
Docker / Containerized: pending
If you have any questions, please reach out to support by opening a ticket in your dashboard as they’ll be able to provide the most specific guidance.