Action required: Critical PHP vulnerabilities - UPDATE

Two critical PHP vulnerabilities have been identified. Action is required to update your applications to use a secure version of PHP.

Who is affected

Any Cloud.gov customer using the PHP buildpack or a custom container image that includes PHP is affected by these vulnerabilities.

What you need to do

Versions of PHP with patches for these vulnerabilities have been released.

For customers using the PHP buildpack for their applications, you will need to push or restage your application. Full instructions for restaging your application can be found here but the shortened version is:

cf restage <app-name> --strategy rolling

After restaging or pushing your application, to verify you are using the newest buildpack, run cf app your-app-name and you should see version 5.1.4 as part of your output:

buildpacks:
	name            version   detect output   buildpack name
	php_buildpack   5.1.4     php             php

For customers using a custom container image for their applications, update your image to use the latest, patched versions of PHP. Then re-deploy your application on Cloud.gov using the new container image version.

What Cloud.gov is doing

The Cloud.gov team is monitoring the platform for any signs of compromise related to these vulnerabilities.

If you experience any issues after the upgrade, please reach out to support@cloud.gov.