PHP Security Vulnerabilities October 21

The overwhelming majority of customer sites are now fully patched and back online. We are actively working on the remaining sites and expect to restore them within the next few hours.

Thank you for your patience and understanding throughout today’s event.

Sites are coming back online.

PHP security patches are now available, and we are installing them across our hosting environment. We have begun restoring sites as each one is fully patched, and we expect restoration to continue over the next several hours.
What this means for you

If your site is back online, it has been patched against both PHP vulnerabilities.
If your site is still offline, it is in the queue. You don’t need to do anything. We’ll restore it as soon as its patches are installed.

We’ll keep posting updates here as restoration progresses. Thank you for your continued patience.

Thank you for your patience during this global security event. Patches for the PHP issues are beginning to be received, although there are several packages for each of the many versions of PHP that we run. We are actively updating all sites with the patches as they are ready but will not be restoring a service until that site is fully patched. We don't have a clear timeframe on when the full set of patches will be completed, but we are actively moving towards the goal. We will continue to provide updates as we make progress.

Open LMS has taken all customer sites offline as a preventative measure.

Why: Two critical zero-day vulnerabilities in PHP have been discovered and are being actively exploited. No mitigation is currently available, so taking sites offline is the only way to fully protect them. These vulnerabilities affect PHP-based websites worldwide and are not specific to Open LMS.

What's next: The PHP project expects to release patches today. As soon as they are available, we will apply them and bring sites back online.

openlms.zendesk.com/hc/en-us/articles/31214374861084

What is happening: Open LMS is taking all customer sites offline within the next few minutes.

Why: Two critical zero-day vulnerabilities in PHP have been discovered and are being actively exploited. No mitigation is currently available, so taking sites offline is the only way to fully protect them. These vulnerabilities affect PHP-based websites worldwide and are not specific to Open LMS.

What's next: The PHP project expects to release patches today. As soon as they are available, we will apply them and bring sites back online.

openlms.zendesk.com/hc/en-us/articles/31214374861084