Update your PHP ASAP 🚨

If you have, use Cloudflare. They have released a WAF rule to protect - doesn't solve the issue, since is needed a PHP update, but can protect something for Cloudflare enable websites.

If I'm right the Cloudflare WAF is only available with enterprise plans, not on the free tier?

No. The mitigation is for free and paid accounts.

From another thread on here, this is an absolute lifesaver - a standalone php builder that works alongside CWP but allows you to install any version you want (include more uptodate versions that CWP hasn't added to their repo yet)

I just installed it on my AlmaLinux 9.8 server, had it build php-fpm 8.5.12

It upgraded it in place for CWP, the client site works perfectly too.

https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

From another thread on here, this is an absolute lifesaver - a standalone php builder that works alongside CWP but allows you to install any version you want (include more uptodate versions that CWP hasn't added to their repo yet)

I just installed it on my AlmaLinux 9.8 server, had it build php-fpm 8.5.12

It upgraded it in place for CWP, the client site works perfectly too.

https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

That works for the public PHP - and is great.
But:
1- Is NOT a official tool from CWP
2- Doesn't fix the issue with the internal PHP that CWP uses.

Absolutely correct.
The internal PHP version is 7.1 or 7.2, there is no update available to patch such an old version I don't believe.

The response from the CWP "team" about this issue, in ticket:

"Thanks for writing in.
We're aware of this and the patch will be very soon. Kindly standby for further update.
Please do not hesitate to contact me, should you need any additional assistance or have further queries. I remain at your service."

The same generic and vague response every time there is a security issue. Every single panel - paid or not paid - have already provide at least **some** info about what they are doing.
CWP have almost every single server where he is vulnerable.

This will have repercusions - lets remind that EU, where CWP is providing they services - have severe fines and rules about cybersecurity. Everytime there is a security incident, CWP doesn't take responsability, or even worst, try to hide it and pass it as a "silent update".
CWP, as a company, have responsabilities - and no, the fact that LINANTO LLC (the main company) is in Georgia doesn't take responsability of follow the EU rules (where is also providing the CWP and other services).

===

For now, to anyone:

1- Use the "Standalone CWP PHP CLI Build Manager" to update the PHP for all the configurations:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/
Is easy to follow and install.
Update ALL the PHP versions that are active, if you have more than one. Make sure to use the correct patched versions:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

All the older versions are EOL, and don't have a patch. If you are still using them, UPDATE NOW to a more recent version.


2- About the CWP panel itself, there is nothing that can be done to update the internal PHP. Is currently vulnerable, and it WILL be attacked - have passed already several hours, so expect bots and malicious traffic exploiting the vulnerability.
As recommendation: CLOSE NOW the CWP ports at the firewall level (2030,2031,2082,2083,2086,2087,2304).
Yes, you lose the CWP panel access, but is better than a server attacked due the incompetence of the CWP team.

3- Wait for the CWP update... And bet with me: will be another silent update, where no one from CWP team provide any info or will be again very vague, and will come several DAYS after. Too little, too late.
Since this will probably need several changes to the internal CWP panel PHP, and to the code within, i can guess will not be a easy task. CWP have been negleting the internal PHP for years, and NOW is paying the price of that... despite all the warnings of the community and not the "devs-wannabe".