While you should probably take some services offline altogether, FreshRSS has an update out.
Just one of many updates that we’re going to be seeing over the next few hours / days.
For those who haven’t seen it yet
https://therecord.media/php-script-vulnerabilities-warnings
Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
Nice. FreshRSS is the only PHP application I have running. I decided to just take it down this morning.
I tried to update mine and saw that there wasn’t an easy path to update it yet, so I decided to do the same
It’s weird seeing the widget on my phone blank now
The vulnerability is in PHP. This FreshRSS release addresses the vulnerability by updating the version of PHP in the container image. If you’re not using the official FreshRSS container image, you just need to update your PHP.
