Letschat needs an upgrade

[klondike]

A serious PHP vulnerability has been found that impacts all versions of PHP that have been in use for years and years.

https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

This is only being patched in the latest version of PHP. The forum is running on an Amazon Lightsail server with an outdated version of PHP. This means I need to set up a new server once Amazon have upgraded their instances. I imagine this will be soon but until they have there is nothing I can do to fix this.

About three quarters of the internet runs on PHP so hackers will be active but hopefully not bothering with small beer like us. If we do get hit you may see errors or the server may go down completely. I take daily backups so should be able to restore the forum and get going with just the loss of some posts unless the server itself gets impacted.

Setting up a new server once Amazon have fixed new instances will take me a while too.

[Mups]

Klondie, first of all,  thank you for warning us.

When you say we might see 'errors',   can you explain (simply please),  what sort of errors to look for?
And secondly,   if it did happen,  what's best to do about it?

Thanks.

P.S.  Sorry,  just thought,  is the forum going to be closed while you do the necessary work?

[klondike]

No idea what errors but if you can't get in or read or post stuff then that is certainly one. The problem is a vulnerability that allows hackers to gain access to the server and create mischief. I imagine that right now huge numbers of sites are vulnerable and many will remain so for a long time to come.

I won't close it because it will likely take a long time to set up and migrate to a patched server and the current one cannot be patched.

[Alex]

Sounds so complicated Klondy, and thanks for continuing to keep us on air. It seems a long time since Christmas 2021 when a few of us toddled over from the Mother Ship ! 

[Scrumpy]

Thank you Klondike..Thank you for all the efforts you have put into running this forum for us over the years..

[klondike]

I created a fresh instance with a supposedly patched PHP but that instance wasn't working at all so I deleted it. I'll try again in a couple of days as I think Amazon have cocked up.

[morty]

All that was double Dutch to me ....   ... but I do know that in the past you went the extra mile to provide a safe home. 

I gather it was AI that spotted the flaw creating so much havoc.
 

[Raven]

Just have to take it one day at a time I suppose.

[klondike]

It's fairly straightforward

Amazon sell virtual servers - i.e. you shouldn't be able to tell if it's a virtual server or a real bit of hardware you send your commands to.

There are lots of types and the one I use is preconfigured as a webserver - software is Linux (operating system) Apache (web server) MySQL (database) and PHP which is a scripting language that is extensively used in websites. That makes it what is known as a LAMP server and there are millions of them on the internet. Getting it that way saves the effort of installing all the software although you do have to configure it and install whatever you want to run. In this case the forum plus some bits and bobs of personal software. 

To set it up you just add an "instance" to your account specifying what server type it will be and start it up (click menu option).  I did that but what came up wouldn't interact with the desktop tools it needed to. It did have a working command line console and it looked to me like none of needed software was on it and certainly not running which it should have been so I deleted it and will try again later. I imagine they have been extraordinarily busy because of this and have not built the basic instance correctly. Either that or I screwed up somehow but I can't think how.

[Dextrous63]

I have absolutely no idea what any of that means 😳🤣🤣

But, I'm sure you'll work it out in the end.  Perhaps you could store our email addresses somewhere safe so you can contact us if it does all go boobs up, especially if it means you have to create something new or it'd cost too much for you to bother.  That way, maybe we could find another place to join/meet up on?   I assume the mothership might be in the same boat, so there may not be a safe bet.  🤷🏻�♂️

[klondike]

I can restore the forum easily enough and fairly quickly. There are full server backups taken daily too although I've never tested that by restoring one.

[Ruthio]

Many thanks for all your hard work ✔ 🙏 🙌 💜 

[GrannyMac]

Thank you. Without you we wouldn't have this. 👏🏼👏🏼

[klondike]

I've got a server that seems to work but am on a pause - I think Vodafone must be cracking down on routers other than there own as mine now refuses to connect to the internet, I'm using theirs on WiFi for this but will have to put my stuff on their router. All my wired network is still on my own router but obviously without internet. Right old PITA when I have other stuff needs sorting. 

[Alex]

I've got a server that seems to work but am on a pause - I think Vodafone must be cracking down on routers other than there own as mine now refuses to connect to the internet, I'm using theirs on WiFi for this but will have to put my stuff on their router. All my wired network is still on my own router but obviously without internet. Right old PITA when I have other stuff needs sorting.

Good job we trust you Klondy because I think this post is written in Romanian