[Love Calm Quiet]

I'm surprised that I've not heard reference in these forums to the trashing of web sites by a Google-aided (till they blocked it) invasion:
http://secunia.com/advisories/13481/

I think it was even mentioned on BBC-Tech: as having trashed *hundreds* of PHP/MySQL-driven BBs.

Neither of my hosts has updated from PHP 4.3.09 to 4.3.10 (the fix), has the host for THESE forums?

Also, does anyone know if this presents a vulnerability to my PHP-based site, even tho it is not running a BB? (I got the impression that the BB was simply the way the ?trojan? sought out victims - not necessarily necessary to the vulnerability)

[Phil Sherry]

i use (mt) Media Temple, and they emailed me this morning to tell me they've upgraded their PHP installation to 4.3.10 because of this vulnerability. MT rocks.

[Scotttheking]

My server:

scott@www:~$ apt-cache policy php4
php4:
Installed: 4:4.3.10-2
Candidate: 4:4.3.10-2

From my hosting provider:

PHP version 4.3.10

[Millennium]

Theoretically it might affect other PHP code, but it would depend on the way that code was written. If you don't use a database and you never open files based on user input, then you are probably OK, but we'd need to see your code to be sure. In any case, even if your own code is safe then it cannot hurt to upgrade, in case you need to use other code in the future which might be vulnerable.