Yeah it’s self hosted, thanks

Ah that makes more sense, that’s the key I was missing, thank you

Seriously though, how quickly do you expect patches to be available for WordPress? I’ve got one WordPress site that I made years ago for a friend’s business. I pop in on it and update stuff every few months.

Should I take it down?

Why do it this way? I’m genuinely unaware.

With the plex2shell, they fixed it in a previous update, then told us later.

If PHP knows what the problem is, why announce it now, and then release the patch. Why not release the patch, say hey guys this is an important one, and then tell the world/every script kiddie who didn’t know about php2shell AFTER everyone is patched?

Like I get it, I guess, php2shell must already be happening, the vulnerability is already there, but like… Shut up about it? Right? Let more people patch before you announce why the patch exists?

I’m new to this world so maybe this is normal?

I checked tmp, and looked for suspicious processes or cron jobs, checked logs, I don’t see any reason to think I was impacted.

So that’s good.

Am not sensible admin. Though I did just run a backup and update. How likely am I FUBAR?

Edit: I run Plex on a dedicated proxmox VM. Theoretically I could nuke it and start over with my Plex database file. Though there’s some config I’d have to do again and I don’t want to