Websites are returning 403 errors from OpenResty on POST requests

Identified - We have received confirmation from iFastNet about this issue.

Earlier today, a critical update to PHP was released that fixes two severe security issues. These issues could cause serious harm on our hosting if exploited.

Our hosting runs PHP packages provided by CloudLinux. CloudLinux has not yet distributed the fixed PHP version. We are waiting for them to provide the PHP version that contains the security fixes.

Until then, to keep our hosting and all websites on it safe, iFastNet was forced to block certain requests from reaching PHP, which includes blocking all multipart/form-data POST requests.

This block will remain in effect until the new PHP packages are published and rolled out on all hosting servers.

Investigating - We have investigated the issue and have a better idea of the impact.

• The problem occurs when making a POST request to websites using the multipart/form-data content type. POST requests using form-urlencoded data are not affected. Other data types are unclear at this time.
  • Explained simply: some forms on websites will return this error, other won’t. Notably forms that involve file uploads.
• All accounts seem to be affected by this, regardless of website IP or domain name used.
• This issue potentially affects all website software, including WordPress and Laravel. How much functionality is impacted by this issue depends on the website software used.

Investigating - We are currently investigating reports of 403 errors on websites on free hosting. (21 Oct - 17:46 UTC)