Apache Log4j 2, a Java-based logging library developed by the Apache Foundation, is used by numerous enterprise-class applications and cloud services to provide advanced logging capabilities. Depending on if you currently utilize a Managed, or UnManaged service, you may be vulnerable to this newly found Zero day Exploit. For customers who enjoy the benefits of a Managed service, such as our Managed VPS, Managed Dedicated Hosting, or Shared hosting users, you have nothing to worry about, as our services where patched the moment it was available. For anyone Self-managing their services, now is the time to update if you have not already.

On November 24, 2021, Alibaba Cloud’s security team reported a Log4j 2 remote code execution vulnerability to Apache. The exploit takes advantage of some Log4j functions that perform recursive analysis. Which, with specially constructed malicious requests, attackers can trigger remote code execution.

The vulnerability impacts default configurations of several Apache frameworks, including:

• Apache Druid
• Apache Flink
• Apache Solr
• Apache Struts2

In Apache Log4j2 versions up to and including 2.14.1 (excluding security releases 2.3.1, 2.12.2 and 2.12.3), the JNDI features used in configurations, log messages, and parameters do not protect against attacker-controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. ^Source

On December 10, 2021, this vulnerability was officially designated in the NIST national vulnerability database as CVE-2021-44228 (also known as the “Log4Shell” vulnerability). This then expanded to several other found, and later patched, vulnerabilities listed as CVE-2021-45046 and CVE-2021-45105.

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments; remote code execution has been demonstrated on macOS but no other tested environments.

CVE-2021-45046

Apache Log4j2 versions 2.0-alpha1 through 2.16.0, excluding 2.12.3, did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack.

CVE-2021-45105

How the Vulnerability Impacts You

Depending on the type of hosting account you have with The Core Hosting , you may or may not need to take action:

Shared, Reseller, and Managed WordPress Accounts

If you have a shared, reseller, or Managed WordPress hosting account, you do not need to do anything. These servers automatically receive frequent updates that include patches for the Log4j 2 vulnerability.

cPanel published an update to mitigate CVE-2021-44228 the same day the vulnerability was announced. For more information, see cPanel’s blog entry.

Managed VPS and Dedicated Servers

If you have a Managed VPS or Managed Dedicated server, you most likely do not need to take any action – your server is updated automatically with patches for the Log4j 2 vulnerability. The only exception is if you have installed any software utilizing log4j outside of cPanel/WHM you should ensure those installations are updated. All software installed and managed by The Core Hosting has already been updated.

cPanel published an update to mitigate CVE-2021-44228(And the subsequent follow-up patches) the same day the vulnerability was announced. For more information, see cPanel’s blog entry.

Unmanaged VPS and Dedicated Servers

If you have an unmanaged VPS or unmanaged Dedicated server, make sure you keep it up-to-date with the latest security patches. If you need assistance with this, our amazing team of support staff is ready to help! We know that this kind of exploit can be dangerous and sometimes hard to correct. So let us assist.

If you use Log4j 2 it is very important to ensure you have updated to the most recent version. The first patch included another vulnerability which required a second patch.

Java 8 (or later) users should upgrade to release 2.17.0 or higher.

Java 7 users should upgrade to release 2.12.3 or higher.

Java 6 users should upgrade to release 2.3.1 or higher

More information can be found at Apache.

For information about how to install updates on unmanaged servers, please see this Knowledge Base article.

The Bottom Line

Heartbleed, Shellshock; The Log4j vulnerability is only the latest in a long line of security bugs. It isn’t the first, and it surely won’t be the last.

If you have a managed hosting account, you can rest assured that we take care of server configuration and updates for you. If you have an unmanaged server however, we highly recommend that your team upgrade as soon as possible, or reach out to our support for help regarding this Zero day exploit.

What are the PHP 8 improvements and features

Faster code execution

The latest PHP version brings a lot of new things but the one we are obsessed with is JIT (just in time compiler). It is the first time that PHP version has a compiler – JIT – that caches a version of your already interpreted code and generates a machine code as an output (machine code is on with 0’s and 1’s only). The “just in time” compiler promises speed improvements for complex tasks and algorithms and opens new opportunities for the PHP language to broaden its reach and applications. 

Some of you may wonder how JIT relates to the Opcache, which brought significant performance gains to many websites? The main job of the Opcache is to cut the processes of tokenization, parsing, and compiling of Opcodes, which then get processed by the Zend engine. The role of JIT is to save on the execution of the Opcodes by the Zend engine, so it joins forces and intervenes to spare resources where the Opcache cannot help.

It’s worth mentioning a few downsides we have noticed so far:

• Running PHP 8 with JIT might make it harder for you to troubleshoot code errors because it may be harder to locate which piece of your code in this interpreted version is actually at fault.
• If you are running a WordPress site you may not be able to note significant performance improvements thanks to JIT. The WP developers are still working on making WP compatible with PHP 8 and are now calling for testers, meaning you won’t be really able to Test PHP8 on your WP site right away. Also, because of the way WP interacts with MySQL, a lot of the waiting time does not come from the PHP compilation, but from the MySQL response time, which cannot be solved with the help of the JIT compiler.  

Code with higher quality 

One of the major differences that you will notice is that many of the warnings and notices that weren’t catchable are now exceptions or errors, which can be caught and logged. It is possible that due to this change, a lot of problems that remained hidden with the previous PHP versions will now surface. This is a great improvement, as it will allow developers to spot potential issues easier. However,  have in mind that it may be a good idea to set display_errors=Off if you decide to use PHP 8 on a live site to not show such errors to your site visitors.

Cleaner, shorter code

Some of the new elements, such as the nullsafe operator, greatly improve the readability of the code, making it shorter and neater.  Instead of nesting several “if’s” you can use the “null” operator to write all those in just 1 line of code. 

The “type” trend

For several versions now, PHP has been trying to define the arguments that each method could adapt and become more of a typed language. In this latest release, there is a feature called “union types” which allows you to define 2 value types for each function, which is a natural continuation of that trend. As the example below shows, the function can return an integer or a float: 

public function getNumber(): int|float {
return $this->number;
}

The list of new features keeps going and we suggest this article as a good reference point for PHP developers:

https://stitcher.io/blog/new-in-php-8
https://stitcher.io/blog/php-jit
https://wiki.php.net/rfc/nullsafe_operator

How to take advantage of PHP 8 on our platform?

All our clients can change the PHP version of their sites from their control panel – For Managed WordPress Clients, Go to your Control Panel, Select PHP Settings, Then change the version – For Shared hosting, cPanel Control Panel –> MultiPHP Manager to change your PHP Version. With PHP8 still being a Release Candidate, we strongly advise that you do not enable it for your live sites, but run tests with it on our staging environment (Staging environments can be created on any plan, If you have trouble doing this, please feel free to reach out to our support team for information on how to do this.), or create copies of your sites in your accounts if you do not have the staging functionality. 

Currently unavailable in PHP 8

The following extensions and modules are not currently available for PHP 8:

• PHP-PSR
• Snuffleupagus
• Phalcon 4
• ionCube 10
• Memcache
• SourceGuardian

Incompatible with PHP 8

The following software currently does not work with PHP 8. This list is not comprehensive.

• DSO — cPanel & WHM does not support the DSO handler with PHP 8.
• The XMLRPC extensions — This extension moved to PECL.
• The JSON extension — This functionality is included in PHP 8 by default.

Begin learning PHP

Get started learning PHP at these great locations:

• https://jobtensor.com/Tutorial/PHP/en/Introduction

Tell us what you think

We tried to give you the big picture of what the new PHP 8 is all about. Now we would like to hear what you actually think about it, once you get the chance to try it out. What do you like and what do you dislike? How does it work on your website? Do you see any performance improvements? We are looking to explore how our more experienced users take advantage of this early release candidate before it becomes official.

What does this mean for you?

If you’ve been keeping your PHP applications up to date (you should be!) then moving to a new version of PHP should be little to no problem. PHP applications that are being developed on a continual basis, will almost always be supporting the latest in server software. This is especially true for PHP applications.

However, we all have lives away from the screen and we tend to forget about the software we have installed to run our online website/applications. which means they tend to get overlooked when it comes to updates. If you’ve not been keeping your PHP apps up-to-date, then the first thing to do is check with the developer and see if there are updates to the applications you are using. If there are newer versions of your application, then updating your application should be relatively straight forward. Many of today’s PHP applications, such as WordPress, have the ability for automated updates to make moving to a new version fairly straight forward.

No matter what, however, The one thing you should make a top priority is moving away from PHP 5.6. Not moving away from 5.6 could lead to your site and serve being compromised, as security vulnerabilities will, and more than likely already have been found.

Why moving to PHP version 7.1 or higher is the right thing to do.

Speed!

PHP 7 saw a rewrite of the Zend Engine, introducing what is called ZendEngine NextGen, adding one of the largest speed enhancements to PHP applications ever. PHP 7.1 and higher versions add immense performance increases to PHP applications that were running on PHP 5. Most tests conducted show speed improvements of almost double to triple for WordPress and most common CMS applications.

Code compatibility

With a new Major version of PHP (That being 7.x), most application developers will be dropping support for 5.6. In most cases, without upgrading your PHP version, you will be unable to upgrade your application or will have issues if you do. In other words, the transition stage of migrating PHP applications seamlessly from PHP 5 to PHP 7 is closing fast.

Security

As of now, PHP 7.0 has already reached its EOL period and is no longer maintained. But PHP 7.2 does not end its EOL until January 1st, 2021, and PHP 7.3 until January 1st, 2022. This means you will always have security updates and fixes until those times.

How do I move to PHP 7.1 or higher?

That’s the easy part! If you are one of our DIY or Managed WordPress Hosting clients, no need to worry about upgrading because you’re already using the most current version! If you’re hosting with another provider, the best thing to do is to check with their support team to see if they have them available. Alternatively, on Cpanel based systems, you can easily swap version using the build-in MultiPHP version change system.

Motivated to move away from PHP 5.6?

Hopefully, we have helped you to see the benefits of moving away from PHP 5.6. If you want to move away, and either is not able to or do not know how to, then contact us! With our new Managed WordPress Service, we will help maintain, update, secure and optimize your WordPress site, and help the transition process much easier. Or make the migration to us today, We will match or do better than your current pricing! We offer both DIY(Do it Yourself) hosting for those who want to control all aspects of their site, as well as Managed WordPress Hosting where we take care of all the backend work for you! Contact our sales team today!