Security Critical open hole in PHP creates risks

[J65nko]

From http://h-online.com/-1567532

The US CERT is warning of a critical vulnerability in PHP which has been disclosed, by mistake, to the public while the developers are still working on a fix. The vulnerability affect servers that are running PHP in CGI mode; FastCGI for PHP installations are not affected.

[Carpetsmoker]

This is *only* when using PHP in CGI mode, which is pretty rare nowadays. If you're still using CGI, this is a good time to switch to FastCGI.

Also note it may be that only Apache is affected, from http://www.hiawatha-webserver.org/weblog/36

I took a closer look at the bug report and found that it's not PHP that is vulnerable, but PHP in combination with the webserver (Apache?) used by the bug reporter. When using Hiawatha, you are not vulnerable. Hiawatha does not (of course!!!) add URL parameters to the command line when executing PHP in CGI mode.

[J65nko]

Also see PHP patch quick but inadequate

[Carpetsmoker]

[J65nko]

For another update see PHP team makes another attempt to close critical CGI hole