This seems to be a pretty big deal. I hope everyone that sees this patches their hosts as soon as possible.
Should add that there is a node.js CVE out too. Patched my Xen Orchestra last night for node.js and my Opnsense for php.
The only website we have is on a shared host, so that company has put a mitigation in place while they patch, and claim over 70% of all hosts have been patched since yesterday.
The only thing I’m concerned about is KASMweb, I’m not sure if it is php or node.js running the web interface. Going to block the access port for now until I can deal with updating it.
1 Like