PHP 脆弱性宣布 - 上传能力已禁用
- identified
作为预防措施,我们暂时取消了社区上传功能。 在此期间,成员将无法上传文件,包括内置图像,剖面图等,并张贴附件. 所有其他社区功能,包括阅读、张贴和答复,都不受影响。 我们没有看到对客户数据或社区可用性有任何影响。 我们期望在工作完成后恢复上传功能,一旦获得更多信息,我们将立即更新这一页面.
- identified
我们正在继续密切监测该平台。 我们的调查没有发现任何证据证明我们正在处理的安全问题被利用了。 作为防范措施,文件上传仍然暂时失效,我们正在努力尽快恢复。 我们将随着形势的发展不断更新这一页.
- identified
PHP 脆弱性( PHP2 Shell): 上传暂时禁用 Gainsight客户社区使用PHP. 10月20日,PHP本身的两个关键弱点(CVE-2026-109618和CVE-2026-109619,简称PHP2Shell)被披露在正式固定之前. PHP安全团队今日10月21日16:00CEST(协调世界时14:00)发布定点. 我们所做的: 禁用所有社区的所有文件上传,包括内置图像,剖面图和后附. 针对这些攻击中使用的请求类型设置额外的防火墙保护. 检查了我们的日志 发现开采的迹象。 目前我们还没有找到任何证据, 接下来会发生什么: 一旦发布, 我们就会在EMEA和美国的基础设施上应用PHP安全更新。 并分享结果。 一旦补丁被应用和核实,我们将恢复上传。 正常地阅读、张贴和答复工作。 我们下一次更新时间是17:00 CEST,如果有任何变化,则提前进行.
- identified
我们正在继续努力解决这个问题。
- identified
更新:PHP安全团队已发布定点. 我们现在正在根据我们的平台验证和测试它。 测试完成后,我们将把它部署在我们的EMEA和美国的基础设施中。 上传文件暂时被禁用,直到安装并核实固定状态. 我们的监测继续显示,没有任何证据表明我们平台上利用了这种脆弱性。 阅读、张贴和答复仍然正常。 我们的下一次更新是5PM CEST, 或者如果有什么变化,更早.
- identified
更新:我们正在测试释放的定律,以确保不引入任何回归. 上传文件暂时被禁用,直到安装并核实固定状态. 我们的监测继续显示,没有任何证据表明我们平台上利用了这种脆弱性。 阅读、张贴和答复仍然正常。 我们的下一次更新将在 6PM CEST, 或者如果有什么变化更早.
- identified
更新:我们正在测试释放的定律,以确保不引入任何回归. 上传文件暂时被禁用,直到安装并核实固定状态. 我们的监测继续显示,没有任何证据表明我们平台上利用了这种脆弱性。 阅读、张贴和答复仍然正常。 我们的下一次更新将是7PM CEST, 或者如果有什么变化,更早.
- identified
Update: We are completing the testing in staging before deploying to production. File uploads remain temporarily disabled until the fix is deployed and verified. Our monitoring continues to show no evidence that the vulnerability was exploited on our platform. Reading, posting and replying continue to work as normal. Our next update will be by 8:30PM CEST, or sooner if anything changes.
- monitoring
Update: The PHP security fix has been deployed to production and we are continuing to monitor closely. We have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 08:00AM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 10:00AM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 12:00PM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 3:00PM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Next update by 6:00PM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Attachments of files pdf, zip, txt is again possible. Next update by 10:00PM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. File uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. Attachments of files pdf, zip, txt is again possible. Next update by 10:00AM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. Image file uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. We will have an update on restoring image file uploads by end of day. Attachments of files pdf, zip, txt is again possible. Next update by 6:00PM CEST, or sooner if anything changes.
- monitoring
Update: We are continuing to monitor and have found no evidence that the vulnerability was exploited on our platform. Image file uploads that render in the page remain temporarily disabled out of an abundance of caution. Reading, posting and replying work as normal. We have started reworking the concerned services to ensure we can restore image uploads as fast as possible. We will have a firm ETA by 25 Sunday 12pm CET Attachments of files pdf, zip, txt is again possible. Next update by 12:00PM CEST, or sooner if anything changes.
- monitoring
Uploads restored: Uploads are available again in all Gainsight Customer Communities. No action is needed. We will continue to monitor closely.
自动翻译自官方事件更新。