Reclaim Cloud and PHP2Shell

Chris Blankenship

— 2 min read
Share
Reclaim Cloud and PHP2Shell

Hello Reclaim Cloud Customers,

We wanted to make you aware of an important security update related to the recently disclosed PHP2Shell vulnerability, which could potentially impact PHP environments running on Reclaim Cloud. These include but are not limited to LEMP, LLSMP, Apache, Nginx, and Litespeed nodes.

Our vendor has made latest patched PHP packages available for Reclaim Cloud. Customers running their own PHP containers will need to log in to Reclaim Cloud and redeploy their PHP environments as soon as possible, but no later than Tuesday, October 27.

You can find step-by-step instructions for redeploying your PHP environment in our support documentation: Changing PHP Versions Within the Topology Wizard

💡
Note that if you are a Managed Hosting customer with an environment that happens to run on Reclaim Cloud, no action is required at this time. The Reclaim team has already applied patches to all Managed Hosting environments.

Because these are self-managed environments, updating the underlying PHP containers requires action on your part. The longer a container remains unpatched, the longer it may remain exposed to a potential security vulnerability. We strongly encourage everyone to prioritize this update rather than waiting until the deadline.

The following versions of PHP are patched against PHP2Shell:

  • PHP 8.2.35
  • PHP 8.3.36
  • PHP 8.4.27
  • PHP 8.5.12

Backports of the patch for older versions of PHP (7.3 to 8.1) are not being provided by the vendor, so only these versions will be available for redeploy. Please be sure you are not re-deploying the currently installed version of PHP, and rather a patched version.

If you cannot redeploy, please update the version of PHP within the container itself. Using the yum/dnf package manager on an LLSMP container, that can be done with the following one-liner:

dnf clean all; dnf makecache; dnf install --enablerepo=remi-safe gd3php; dnf update '*php*'; systemctl restart lshttpd

If your PHP containers have not been redeployed by Tuesday, October 27, Reclaim Hosting will update them to ensure they are running the patched versions. We want to give customers the opportunity to manage this process themselves, particularly if redeployment requires coordination with existing applications or workflows. You can read more about the PHP2Shell vulnerability and our broader response on our blog: Domain of One's Own v2 Migrations and the PHP2Shell Security Vulnerability

We recognize that redeploying containers can be disruptive, especially for customers managing their own applications and infrastructure. If you have questions, concerns, or need assistance with the redeployment process, please don’t hesitate to reach out to our support team.

We appreciate your understanding and cooperation as we work together to keep Reclaim Cloud environments secure.

Thanks,

The Reclaim Hosting Team

Read more