Update your PHP ASAP 🚨

If you have, use Cloudflare. They have released a WAF rule to protect - doesn't solve the issue, since is needed a PHP update, but can protect something for Cloudflare enable websites.

If I'm right the Cloudflare WAF is only available with enterprise plans, not on the free tier?

No. The mitigation is for free and paid accounts.

From another thread on here, this is an absolute lifesaver - a standalone php builder that works alongside CWP but allows you to install any version you want (include more uptodate versions that CWP hasn't added to their repo yet)

I just installed it on my AlmaLinux 9.8 server, had it build php-fpm 8.5.12

It upgraded it in place for CWP, the client site works perfectly too.

https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

From another thread on here, this is an absolute lifesaver - a standalone php builder that works alongside CWP but allows you to install any version you want (include more uptodate versions that CWP hasn't added to their repo yet)

I just installed it on my AlmaLinux 9.8 server, had it build php-fpm 8.5.12

It upgraded it in place for CWP, the client site works perfectly too.

https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

That works for the public PHP - and is great.
But:
1- Is NOT a official tool from CWP
2- Doesn't fix the issue with the internal PHP that CWP uses.

Absolutely correct.
The internal PHP version is 7.1 or 7.2, there is no update available to patch such an old version I don't believe.

The response from the CWP "team" about this issue, in ticket:

"Thanks for writing in.
We're aware of this and the patch will be very soon. Kindly standby for further update.
Please do not hesitate to contact me, should you need any additional assistance or have further queries. I remain at your service."

The same generic and vague response every time there is a security issue. Every single panel - paid or not paid - have already provide at least **some** info about what they are doing.
CWP have almost every single server where he is vulnerable.

This will have repercusions - lets remind that EU, where CWP is providing they services - have severe fines and rules about cybersecurity. Everytime there is a security incident, CWP doesn't take responsability, or even worst, try to hide it and pass it as a "silent update".
CWP, as a company, have responsabilities - and no, the fact that LINANTO LLC (the main company) is in Georgia doesn't take responsability of follow the EU rules (where is also providing the CWP and other services).

===

For now, to anyone:

1- Use the "Standalone CWP PHP CLI Build Manager" to update the PHP for all the configurations:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/
Is easy to follow and install.
Update ALL the PHP versions that are active, if you have more than one. Make sure to use the correct patched versions:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

All the older versions are EOL, and don't have a patch. If you are still using them, UPDATE NOW to a more recent version.


2- About the CWP panel itself, there is nothing that can be done to update the internal PHP. Is currently vulnerable, and it WILL be attacked - have passed already several hours, so expect bots and malicious traffic exploiting the vulnerability.
As recommendation: CLOSE NOW the CWP ports at the firewall level (2030,2031,2082,2083,2086,2087,2304).
Yes, you lose the CWP panel access, but is better than a server attacked due the incompetence of the CWP team.

3- Wait for the CWP update... And bet with me: will be another silent update, where no one from CWP team provide any info or will be again very vague, and will come several DAYS after. Too little, too late.
Since this will probably need several changes to the internal CWP panel PHP, and to the code within, i can guess will not be a easy task. CWP have been negleting the internal PHP for years, and NOW is paying the price of that... despite all the warnings of the community and not the "devs-wannabe".

I use prestashop 8.2, i can't go over 8.1 PHP, and no patch for this branch ??

I use prestashop 8.2, i can't go over 8.1 PHP, and no patch for this branch ??

There is no patch for versions under the 8.2 (they are EOL).
You need to update your installation or make it compatible with recent versions.

I have a alma linux 9 vps, and out of despair i asked Gemini how can i switch to php 8.3.36 and it gave me these directions. I tried it and it works, so use it at your own risk if you will.

1) go to
/usr/local/cwpsrv/htdocs/resources/conf/el9/php_switcher/versions.ini
2) add
version[]=8.3.36
(right over version[]=8.3.33)
3) open terminal
cd /usr/local/src
wget https://www.php.net/distributions/php-8.3.36.tar.gz
4) Go to CWP version switcher and select 8.3.36 and compile
5) It will fail because cwp can't find the 8.3.36 file, so you go to
/usr/local/src/php-rebuild.sh
6) Open it in file editor and change the
# PHP Sources
section all the way until the ioncube line with this

# PHP Sources Check Overridden for Local File
if [ -f "/usr/local/src/php-$version.tar.gz" ]; then
        PHPDOWNLOADVERCWP=99999999
        phpsource="file:///usr/local/src/php-$version.tar.gz"
else
        PHPDOWNLOADVERCWP=`wget -q -S --spider "https://www.php.net/distributions/php-$version.tar.gz" -O - 2>&1 | sed -ne '/Content-Length/{s/.*: //;p}'`
        if [ -z "$PHPDOWNLOADVERCWP" ]; then
                PHPDOWNLOADVERCWP=0
        fi
        phpsource="https://www.php.net/distributions/php-$version.tar.gz"
fi

# Check if file size is over 8MB
if [ $PHPDOWNLOADVERCWP -ge 8000000 ]; then
        echo "Valid archive found, proceeding..."
else
        echo "Failed to Download PHP version $version!"
        exit 1
fi
7) By the way in the file above you should see these lines (because we attempted to compile 8.3.36 from GUI)
# CONFIGURE MIRRORS HERE
version=8.3.36

If you don't see this version there (8.3.36) for any reason, also change it to 8.3.36

8 ) After this you open terminal and
cd /usr/local/src
sh php-rebuild.sh

9) Once it finishes compiling
systemctl restart httpd

10) You check with
php -v

It should show 8.3.36

Worked for me. So I don't know if this is the right way to go, but something needs to be done while CWP is lagging behind.

By the way, when you edit files in File Manager, sometimes a syntax error happens due to new lines being removed or whatever, in which case you need to install this thing called dos2unix, and then run dos2unix /path/to/file   this fixes the problem.

I have a alma linux 9 vps, and out of despair i asked Gemini how can i switch to php 8.3.36 and it gave me these directions. I tried it and it works, so use it at your own risk if you will.

Just use the AlphaGNU script.
Is compatible with CWP and not a "AI made" solution that could work... but also can break many things or in the future.

http://forum.centos-webpanel.com/php/update-your-php-asap-128680/msg54477/#msg54477

I can't upgrade easyly to prestashop 9, it need a full developpement for this migration, template etc.....

Anything non-CWP origin can break things in the future.

No need to fixate on a single alternative. This solution is simply using the official php file to make the update, it's pretty straight forward.

I have a alma linux 9 vps, and out of despair i asked Gemini how can i switch to php 8.3.36 and it gave me these directions. I tried it and it works, so use it at your own risk if you will.

Just use the AlphaGNU script.
Is compatible with CWP and not a "AI made" solution that could work... but also can break many things or in the future.

http://forum.centos-webpanel.com/php/update-your-php-asap-128680/msg54477/#msg54477

This just isn't affecting CWP.

This RCE bug goes back 12 years, and is in allot of software.

cPanel, Plesk, Froxlor just to name a few other panels affected.

ANY system running PHP.

AlphaGNU has a solution, but there is a problem with the Sodium extension not working.

If you have a WordPress theme that uses it, it will crap out WordPress completely. :/

Cloudflare is helping protect yourdomain.com against php2shell

Cloudflare has deployed rules that help block known php2shell attacks. This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.

Package libsodium-1.0.18-1.el7.x86_64 already installed and latest version
Package libsodium-devel-1.0.18-1.el7.x86_64 already installed and latest version
Nothing to do
chdir: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100 28505  100 28505    0     0   215k      0 --:--:-- --:--:-- --:--:--  217k
/usr/local/cwpsrv/htdocs/resources/conf/el7/php_selector/external_modules/8.2/sodium.sh: line 9: /opt/alt/php82/usr/bin/phpize: No such file or directory
/usr/local/cwpsrv/htdocs/resources/conf/el7/php_selector/external_modules/8.2/sodium.sh: line 10: ./configure: No such file or directory
make: *** No targets specified and no makefile found.  Stop.
make: *** No rule to make target `install'.  Stop.
/usr/local/cwpsrv/htdocs/resources/conf/el7/php_selector/external_modules/8.2/sodium.sh: line 14: /opt/alt/php82/usr/bin/php-config: No such file or directory
ERROR: Missing extension file /sodium.so

How I patched PHP on CWP (AlphaGNU PHP manager)

CWP has no update yet, so I used AlphaGNU's standalone build manager. It builds PHP from php.net and installs into the usual CWP paths. It is third-party and not supported by CWP, so read it first and make a backup. I'm on AlmaLinux 9.8 and it worked for me.

1. Back up first: take an LVM snapshot or a copy of your server, plus mysqldump --all-databases.

2. Download the installer package and read the scripts before running anything:

curl -fsSL https://www.alphagnu.com/upload/cwp-php-manager/cwp_php_manager_alphagnu_v4.zip -o pm.zip
sha256sum pm.zip
unzip pm.zip && bash install.sh

My SHA-256 was f208354fb0dc7aed1264e53cb3200178dcf6f07ce4d2f7ac5fcc48d5882ea89e. Compare it with yours, and read the scripts, since it runs as root.

3. Check which PHP versions your sites actually use (look for php-fpm8x/usr/var/sockets/<user>.sock in /usr/local/apache/conf.d/). Only rebuild those.

4. Build one version at a time, once, in the background so a dropped SSH session doesn't stop it:

nohup php-manager fpm 8.3.36 > /root/build.log 2>&1 &
tail -f /root/build.log

Do the same for 8.4.27 and 8.5.12 if you use them. Don't start two builds at once.

5. Verify afterwards: /opt/alt/php-fpm83/usr/sbin/php-fpm -v, compare "php -m" with the output you saved before the build, and check the pools are running.

6. For the Switcher PHP (/usr/local/php, used by the CLI): php-manager switcher 8.5.12. This restarts Apache, and it removes old shared extensions like imagick and sodium, so check "php -m" afterwards.

Notes:
- Don't press "Save & build" in the CWP PHP-FPM Selector afterwards, or it may overwrite the new build with CWP's own older one. Check "php-fpm -v" after any CWP rebuild.
- CWP's own panel runs on /usr/local/cwp/php71 (PHP 7.4). That isn't changed by this. Keep ports 2030/2031/2082/2083/2086/2095/2096 closed to the internet or limited to your IP.
- The "CWP Security Audit: Unauthorized port: php-fpm" popup is a false alert from CWP's audit script (it reads a unix socket line as a port). It's not caused by this update.
- Builds need RAM; add swap if you have less than ~8 GB.