Recent cybersecurity vulnerabilities

[trunkswd]

Zkuq said:

trunkswd said:

Our sysadmin updated the php on the site to a newer version that has the CVE fix back ported. The plan is to upgrade to the latest version, but he is worried stuff will break on the site. So work will need to be done behind the scenes before doing so.

Thanks for the update! And yeah, if the PHP version used by the site is even remotely as old as I suspect, there's been some pretty notable changes to the language since, and fears of the site breaking are well warranted. I don't know if you have a separate dev/test environment for stuff like this (you really should, but I understand it might not be feasible at the moment), but it would definitely reduce the risk.

I don't know when he will have the time but he mentioned setting up a test site that can run in parallel with the live site for a while, so things can be checked and fixed without any issues on the live site.