As of 14:00 UTC, PHP is slated to put out a critical PHP security release for two critical vulnerabilities. Both of these vulnerabilities allow remote code execution on the server, meaning they are rated at VCSS v4.0 9.2.
For our web hosting customers, we will ensure that any available updates provided by PHP are applied on our servers as soon as possible, but this may not be enough. If you can, we recommend following the guidance on this blog post from Sansec: https://sansec.io/research/php2shell. It includes turning off any multipart/form-data inputs, making your platform read-only and changing PHP settings.
If you have any questions, please contact our support at https://support.tfdidesign.com/.
Update: We can confirm that our servers have patched PHP versions 5.6 and beyond. We have disabled PHP versions 5.3 and 5.5 and moved customers on those versions to PHP 5.6.
