Websites are returning 403 errors from OpenResty on POST requests

Resolved - The PHP update has been successfully rolled out to all servers, and the temporary block on multipart/form-data POST requests has been removed since it’s no longer necessary. (22 Oct - 12:52 UTC)

Identified - iFastNet is currently preparing the PHP updates. Once they are ready, they will be rolled out to all servers, and the temporary block on multipart/form-data POST requests will be lifted. They expect to be able to complete this within two hours. (22 Oct - 08:57 UTC)

Identified - CloudLinux has released updated PHP packages over the night to address the vulnerabilities. We are trying to get confirmation from iFastNet about when these updates will be rolled out. (22 Oct - 08:47 UTC)

Identified - We have received confirmation from iFastNet about this issue.

Earlier today, a critical update to PHP was released that fixes two severe security issues. These issues could cause serious harm on our hosting if exploited.

Our hosting runs PHP packages provided by CloudLinux. CloudLinux has not yet distributed the fixed PHP version. We are waiting for them to provide the PHP version that contains the security fixes.

Until then, to keep our hosting and all websites on it safe, iFastNet was forced to block certain requests from reaching PHP, which includes blocking all multipart/form-data POST requests.

This block will remain in effect until the new PHP packages are published and rolled out on all hosting servers.

Investigating - We have investigated the issue and have a better idea of the impact.

• The problem occurs when making a POST request to websites using the multipart/form-data content type. POST requests using form-urlencoded data are not affected. Other data types are unclear at this time.
  • Explained simply: some forms on websites will return this error, other won’t. Notably forms that involve file uploads.
• All accounts seem to be affected by this, regardless of website IP or domain name used.
• This issue potentially affects all website software, including WordPress and Laravel. How much functionality is impacted by this issue depends on the website software used.

Investigating - We are currently investigating reports of 403 errors on websites on free hosting. (21 Oct - 17:46 UTC)