Short version: a serious security issue was found in PHP, a common building block used by websites and web applications. MediaCP has released updates for every supported release tier. If you administer a MediaCP server, the fix is simple: run the normal MediaCP upgrade utility now.
What happened?
PHP is software that helps a web server run dynamic websites and web applications. Two serious weaknesses in PHP, collectively known as PHP2Shell, could let an attacker send a specially crafted request to an unpatched server and potentially take control of part of it.
In plain English: it is like discovering a fault in a widely used engine component. The issue is in the component, not in every product that uses it.
Is this caused by MediaCP?
No. This is an upstream PHP vulnerability, not a vulnerability introduced by MediaCP software. PHP is used across the web by many different products and platforms.
MediaCP acted quickly once the upstream PHP patch became available, releasing MediaCP updates within minutes for all supported release tiers:
Why is this important?
PHP is used by a very large part of the internet. Reporting has estimated that it supports around 70% of websites where the server-side programming language is known. That does not mean 70% of websites are affected, but it explains why an issue in PHP receives worldwide attention.
The concern is that an unpatched, exposed server could be targeted without an attacker first needing a username or password. That is why the practical answer is to install the update promptly.
How do I fix it?
You do not need to install a custom PHP version or make complex configuration changes. Simply:
- Follow the MediaCP upgrade guide.
- Run the MediaCP upgrade utility normally.
- Confirm the upgrade completes successfully and that your server is on the current build for its release tier.
That is all that is required for supported MediaCP releases.
Further reading
This was major international technology and security news. You can read more from:
For the technical details and upstream security advisory, see PHP.net.
