PHP foundation announced a critical update for PHP versions to address major vulnerabilities. Is this something that needs to be implemented on the user end or does Concrete implement these updates?
Our website is hosted at Portland Lab servers and is running on PHP 8.2.34.
Heard from support that this is being addressed by Portland Labs and may affect the ability to upload files throughout the day as the patches are applied
Our Canadian government put out this release about versions that are affected. It suggests that 8.5.12 is fixed but that version has been available on SiteGround for at least 2 weeks because I just updated a site and put it on the newest version which was 8.5.12. Any thoughts on this?
| Affected Versions | Fixed Versions |
| 8.5.x prior to 8.5.12 | 8.5.12 |
| 8.4.x prior to 8.4.27 | 8.4.27 |
| 8.3.x prior to 8.3.36 | 8.3.36 |
| 8.2.x prior to 8.2.35 | 8.2.35 |
Apparently, SiteGround fixed their version ahead of the public announcement.
SiteGround moves early to protect customers ahead of critical PHP security release
This all tracks with the info I have been able to find, hacker news (who first published the issue) has the same chart with Affected Versions vs Fixed Versions as well as tips on spotting errors that may suggest a server has been infiltrated. PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge