No components marked as affected
Resolved
This has now been resolved.
Monitoring
The security patch for the PHP vulnerability has been released and applied. All Trybe services are now running the patched version of PHP.
Before the patch was released, the Trybe application was protected by emergency Web Application Firewall (WAF) rules that Cloudflare deployed for this vulnerability.
We’ll keep monitoring and will mark this incident as resolved shortly. You don’t need to do anything.
Identified
Our engineering team was made aware of the PHP CVEs last night and has been in close contact with our infrastructure provider since then. Here is where things stand:
Patch: Our infrastructure provider will apply the security patch automatically as soon as it is released. The release is expected at 3pm UK time today (14:00 UTC).
Interim protection: The Trybe application sits behind Cloudflare. Cloudflare has deployed emergency Web Application Firewall (WAF) rules for this vulnerability, which protect us until the patch is applied.
NCSC acknowledgement: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
