AWS lightsail: Lightsail: add note on Sury repo fixes for PHP 5.6–8.1 vulnerabilities
Summary
Replaces the plain 'upgrade to a supported version' line with a Note recommending PHP 8.2+ and explaining that the third-party Sury PHP repository (packages.sury.org) has published fixes for the PHP vulnerabilities for PHP 5.6 through 8.1 on Debian, with a caveat that Sury is not AWS-owned or maintained.
Security assessment
The page documents remediation of known PHP security vulnerabilities; the added note gives concrete patching guidance (Sury repo fixes for PHP 5.6–8.1) and a security caveat that the repository is third-party and not maintained by AWS, which is relevant to supply-chain trust. No specific CVE is named, so severity is medium rather than high.
Evidence
We recommend that you use PHP 8.2 or later. PHP 8.1 and older no longer receive updates from the PHP project. However, the Sury PHP repository (packages.sury.org) has published fixes for these vulnerabilities for PHP 5.6 through 8.1 on Debian.
Diff
diff --git a/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md b/lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md index f3add25..aca6089 100644 --- a//lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md +++ b//lightsail/latest/userguide/amazon-lightsail-update-php-security-vulnerabilities.md @@ -29 +29,5 @@ PHP release line | Fixed version -PHP 8.1 and older no longer receive updates from the PHP project. If your instance runs one of these versions, upgrade to a supported version. +###### Note + +We recommend that you use PHP 8.2 or later. PHP 8.1 and older no longer receive updates from the PHP project. However, the Sury PHP repository (packages.sury.org) has published fixes for these vulnerabilities for PHP 5.6 through 8.1 on Debian. If you can't upgrade to PHP 8.2 or later right away, you can install these fixes from the Sury repository, and then plan to upgrade to a supported version. For the commands to add the Sury repository, see Add the Sury PHP package repository and install PHP-FPM. + +The Sury PHP repository is a third-party repository. It is not owned or maintained by AWS. For more information, see the [Sury website](https://deb.sury.org/).