Monero CCS website temporarily 'disabled' after disclosure of critical PHP vulnerabilities

<p>Core Team member binaryFate<sup id="fnref:1"><a href="#fn:1" class="footnote" rel="footnote" role="doc-noteref">1</a></sup> has temporarily disabled the Monero <em>Community Crowdfunding System</em> (CCS)<sup id="fnref:2"><a href="#fn:2" class="footnote" rel="footnote" role="doc-noteref">2</a></sup> website/app after the public disclosure<sup id="fnref:3"><a href="#fn:3" class="footnote" rel="footnote" role="doc-noteref">3</a></sup> of two critical PHP vulnerabilities that can allow remote code execution:</p> <blockquote> <p>Hey everyone FYI, in the light of the PHP RCE issues I have disabled the CCS website/app as an emergency measure until we find out how to upgrade safely. (binaryFate)<sup id="fnref:4"><a href="#fn:4" class="footnote" rel="footnote" role="doc-noteref">4</a></sup></p> </blockquote> <blockquote> <p>Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now.<sup id="fnref:5"><a href="#fn:5" class="footnote" rel="footnote" role="doc-note