1

Our hosting provider wants to update our legacy application server (Plesk).

We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL.

Now the thing is, our provider wants to remove these old PHP versions for "security reasons". But I'm failing to see, how the removal of available PHP versions increases security (in real life scenarios).

I understand that changing the project codebase may increase security or that a newer PHP version might fix OS (environment) related security issues, but I can't see any attack vector from HTTP to the underlying PHP interpreter.

So, can we say it is "fairly safe" to run an outdated PHP version in an otherwise updated server?

Improve this question

2 Answers 2

Reset to default
3

Considering PHP v5.3 and v5.6 are end of life for a while, no more patches, (security) fixes or updates will become available even if security issues are discovered.

Your hosting provider is quite late in removing these PHP versions considering v5.6 is end of life since December 31st, 2018.

So, can we say it is "fairly safe" to run an outdated PHP version in an otherwise updated server?

No, we can't. There is no reason to continue using outdated software. The software written in PHP < v5.6 should be upgraded to the newer PHP v7.3 standard.

Improve this answer
1
  • 3
    I would add that there are known vulnerabilities that exist in legacy versions of PHP that, due to every version from 7.0 and before being EOL, will not be addressed in any official release. This includes cvedetails.com/cve/CVE-2019-9641 which allows an attacker to severely degrade performance to the point of a trivial DOS attack (a buffer overflow allows remote attackers to crash the web SAPI processes, which often crashes web server processes as well; but fortunately does not allow them to specify a payload). So yes, it is not "fairly safe" to run any EOL version of PHP.
    – Ghedipunk
    Sep 23, 2019 at 15:57
2

Even though you developed your code with security and privacy by design, audited the result and have continuously monitored CVEs to be sure that there are no (known) issues that affect you, that doesn't mean everyone else has, too. Presumably you're in a shared hosting or VPS environment: your hosting company is in the business of providing a secure OS, bandwidth and disk space, not auditing other people's code. By removing older versions of PHP they prevent someone else on that server from accidentally or unsafely using that older version and compromising the entire server, which improves your security (and your uptime).

If you really need an older version of PHP, upgrade to a dedicated server and take on the responsibility of securing the server yourself (I'm sure your provider will be happy to help with that, with an additional support contract). Or install that version of PHP locally (and be prepared to be kicked off your hosting provider if you do have a vulnerability that ends up compromising their server).

Improve this answer
2
  • Thanks a lot. That was the kind of answer I was looking for. It is already a (managed) dedicated server, so there is no risk that other clients might attack us. I know it's bad in theory, but I just can't think of a scenario where an attack from outside is successful simply because there is an outdated PHP version active.
    – user196058
    Sep 23, 2019 at 15:51
  • If they're continuously monitoring CVEs as you suggest, they'd know that there are currently no EOL versions of PHP that don't have severe vulnerabilities (such as cvedetails.com/cve/CVE-2019-9641 among several others).
    – Ghedipunk
    Sep 23, 2019 at 15:59

You must log in to answer this question.