Update your PHP ASAP 🚨

Yes -- all levels of accounts (Free, Pro, Enterprise)

Cloudflare is helping protect yourdomain.com against php2shell

Cloudflare has deployed rules that help block known php2shell attacks. This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.

CWP updated PHP in 1.21, which is good.

Others still haven't released fixes. :/

FYI: If anyone doesn't know, Cloudflare's WAF is built using the OWASP CRS Ruleset as the base.
Just as many other's are as well, then tweaked.

Until a CWP update silently update the internal PHP to a 8.2+ version, is RECOMMENDED to close all the ports used by the panel.

Well, unless you live behind Cloudflare as I do. They already have mitigations in place to block malicious PHP2shell traffic. But yes, hopefully the devs get on to 8.3 or 8.5 for CWP's internal version. 7.2 is long past old in the tooth and more of the fossilized relic class.

Cloudflare indeed have protections agains this, but do nothing to protect CWP panel itself.
The mitigations from Cloudflare are only to the proxy domains - that you probably don't have in the URL of the server with CWP (and you shouldn't, since is not intended to that use and cause issues). Or even with the server IP access itself...
In fact, Cloudflare itself completly ignores the traffic in certain ports - like the 2087 and similar.

So:
Cloudflare CAN protect your websites.
Cloudflare DOESN'T protect your CWP panel or server, along with services in it, like RoundCube.


The lockdown at firewall level of all the ports continues to be RECOMMENDED

Running that now...

Why isn't CWPRO7 distributing this update?
What's the issue with their development team?

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

Running that now...

Why isn't CWPRO7 distributing this update?
What's the issue with their development team?

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

CWP 1.21 came out last night, and has all the currently support php.net versions wit the fixes for 8.2, 8.3, 8.4, 8.5

If you don't have 1.21, that means your autoupdate failed or your have the cron disabled.

You can manually update using the Update CWP button in the GUI or from the /scripts directory with ./update_cwp

Thnx!

Building PHP right now...

That update was pretty decent. However the the CWPRO7 software is still an issue?
Patched 7.4 branches do exist, my cPanel server has them.

Running that now...

Why isn't CWPRO7 distributing this update?
What's the issue with their development team?

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

CWP 1.21 came out last night, and has all the currently support php.net versions wit the fixes for 8.2, 8.3, 8.4, 8.5

If you don't have 1.21, that means your autoupdate failed or your have the cron disabled.

You can manually update using the Update CWP button in the GUI or from the /scripts directory with ./update_cwp

Thnx!

Building PHP right now...

That update was pretty decent. However the the CWPRO7 software is still an issue?
Patched 7.4 branches do exist, my cPanel server has them.

CWP uses the Official PHP version from php.net.
Once a version goes EOL, there is nothing for CWP to grab and build.

Not sure how cPanel has PHP 7.4 patches, since PHP.net doesn't have any, and it is an EOL product.
Unless cPanel is doing in-house somehow. Then it isn't an Official php.net version.
Which is OK.

I know TuxCare offers additional support for Kernels, etc.
https://tuxcare.com/endless-lifecycle-support/

The versions 8.1, 8.0 and 7.4 has received the patch also, on the php official github:

https://github.com/php/php-src

They offer it only as source, so you would need to build them as you need. From what I know, it might appear the fix for lower versions too, still only by source, but it's not known when.
So CWP took the backported version directly from php github, same did cPanel.