A major PHP RCE vulnerability ("PHP2Shell") was recently disclosed. Phabricator is unsupported as of five years ago and I no longer recall how computers work, but I'm sure this'll be a quick fix and I can get back to collecting inoperable forklifts shortly.
So far:
- I took down secure and Phacility services around 4AM Pacific.
- secure is now back up and running on patched PHP, but I did this by upgrading everything forward. Phabricator itself is five years out of date and most pages are raising errors.