Php2shell

Flame Flame Questions
1

Hey there,

Has anyone successfully upgraded Rocky 9.5 php through dnf update to patch php2shell vulnerability? I’m assuming Flame doesn’t care about php, just wanted to make sure that the upgrade didn’t break anything else along the way.

Thanks!

David

2

Generally, your risk on a Linux Flame system is very low:

  • Your system is unlikely to be Internet facing, but behind a firewall.
  • A stock Flame install does not have any php based web server running. I checked and nothing is listening on port 80/443. There is no attack surface.
  • And if it’s not for that, Rocky uses ASLR (address space randomization), which makes an attack much harder

But if it makes you feel better, then run

sudo dnf upgrade --refresh 'php*'

Then run

rpm -q --changelog php-common | grep -E "CVE-2026-109618|CVE-2026-109619"

and you should see the CVEs mentioned in changelog.

I’ve done it on my system, and no negative effects. Flame launched without error afterwards.

3

I ran a test on over 100 workstations:

httpd and php-fpm are disabled and stopped by default.

I’m waiting for the next adsk rocky updater.

Others may have a different strategy.

4

Thanks to you both! I’m asking on behalf of a client who handles Flame stations at a broadcast company. He sent me the following this monrning:

did you see that php vulnerability thing?

they did a scan and our flame systems came up

5

It depends on how they did their scan.

Did they search for systems that exposed vulnerable webserver connections or did they search on each system if it contained an unpatched version of php?