php2shell mitigations
Due to the recent php2shell vulnerability, to save time and effort for both users and maintainers alike, and out of an overabundance of caution, all Scripts sites have had PHP (php-cgi) disabled until a patch is available and backported.
Because a decent amount of Scripts relies on PHP working, some things (such as signups, the primary Scripts website, etc.) may not function.
Our apologies for the lack of communication and notice,
SIPB Scripts Team
Task list:
- move heartbeat script off of php
- make f20 php show this page
- make f30 php show this page
- disable web server on sliced-bread, just in case
- sliced-bread is too old, enable web server
- review/compare with vperetti's backports
- backport fix to f20
- test f20 fix
- deploy f20 fix
- backport fix to f30 (patch, github, RPMs)
- test f30 fix
- deploy f30 fix
If you have time and like backporting patches (for 5.5.26 and 7.3.18), send them to scripts@mit.edu, please!
