As many know, PHP has announced they have a very serious vulnerability and patch is not yet available:
https://news.ycombinator.com/item?id=50172041
We are turning off all potentially vunlerable services (webpages), until they are secure. This is so you know why some accounts will not be working for a few hours.
Discourse (this Forum) does not use PHP.
Hello,
I would like to know RouterOS / SwOS web UI are using PHP or not ?
Thank you
Regards
No, this is only about webpages. No mikrotik product has PHP
Unless running in container or app menu. 
This is genral advice for now: if you are running any webserver or any kind of container app that uses PHP, shut it down now, if you can, until verified php patches are released and your app works with the new PHP
@normis Do you agree and see how PHP handled these 2 very critical CVE differently to Mikrotik's published critical security updates in early September this year? PHP pre-announced it and you (and the rest of the PHP world) had plenty of time to shutdown/secure your PHP applications. But RouterOS security updates with a comparable CVE score were published without pre-notice and only some hours later the first public systems have been affected.
So:
Not:
oh and how everyone hates this, you should have read the comments online, before posting this ...
They should have shut up, released a new stealth PHP version and told everyone to update ASAP. They gave way to many details ahead allowing some AI agents to find the vulnerability
No matter how you handle it, nobody’s happy.
Here’s what I would have done:
Don't waste your breath here, go and troll the hackernews comment threads. You will have hundreds of people to convince, maybe more
How do you know we don't do that always? 
This is exactly how MikroTik handled it in the past. In times of AI, where every bit of binary and every single release is decompiled and analyzed with no effort by LLM farms. That strategy does not hold anymore.
I also can imagine what
system - improve stability;
stands for in changelogs.
@normis
is there any chance that you can spin up a simple https server (i.e. without PHP) just for the downloads? (WinBox and firmwares for updates)
RouterOS version upgrades (downloads) should be available (the same applies for WinBox, upgrade should be available if you are running older version).
I think for the now 55 Minutes till (14 UTC) its not worth to set-up an replacemnt-server 
We all know what this means 
@normis
Upon rereading, I don’t think what you wrote was directed at me;
rather, it seems to be part of a response you had already begun drafting for the previous post.
If I’m mistaken, please let me know.
Don't waste your breath here, go and troll the hackernews comment threads. You will have hundreds of people to convince, maybe more
Hello! I have a student who wants to take the exam, but the website is down. Is there any estimate as to when it will be back up? I am aware that there is an issue with PHP and that the organization has already provided a fix: https://www.php.net/archive/2026.php#2026-10-21-5. I just want to be able to inform the student and have an idea of the expected timeframe.
How if I need to netinstall?
Ask the Cat:
https://download.mikrotik.com/routeros/7.23.8/netinstall-7.23.8.zip
https://download.mikrotik.com/routeros/7.23.8/netinstall64-7.23.8.zip
https://download.mikrotik.com/routeros/7.23.8/netinstall-7.23.8.tar.gz
https://download.mikrotik.com/routeros/7.24.5/netinstall-7.24.5.zip
https://download.mikrotik.com/routeros/7.24.5/netinstall64-7.24.5.zip
https://download.mikrotik.com/routeros/7.24.5/netinstall-7.24.5.tar.gz
P.S.:
With exceptions,
the version of Netinstall used does not necessarily have to be the same as the version of RouterOS you intend to install...
I’ve always said not to leave WAN ports open to the Internet...
