出发吧爱情

ThinkPHP 5.x漏洞自查清单：你的后台还裸奔吗_我的网站

上班这党事

A | Geneva, Oct 20 (UNI) The World Health Organization (WHO) said that Covid-19 is still a Public Health Emergency of International Concern (PHEIC), the WHO's highest alert level.

The announcement came although the number of weekly deaths is almost at its lowest level since the pandemic began.

The WHO's International Health Regulations Emergency Committee said on Wednesday after its quarterly assessment meeting last week that despite a decline in severe cases of Covid-19, and the falling number of weekly deaths, deaths from Covid-19 nevertheless remain high compared with other respiratory viruses.

It also warned of Covid-19-related complications and post-Covid-19 conditions, with the full impact of these still not completely understood. The outbreak could also evolve during the upcoming winter season in the Northern Hemisphere, the committee said.

Meanwhile, the current gaps in global surveillance of Covid-19 have hindered early identification and evaluation of the virus' evolution. With the virus expected to continue evolving, the committee said that the genetic and antigenic characteristics of future variants cannot yet be reliably predicted. Evolving variants may pose challenges to current vaccines and therapeutics, the committee warned.

"Given the above considerations, the committee concurred that continued coordination of the international response is necessary," and considered that "the situation remains dynamic and requires frequent reassessments, and that the termination of the PHEIC, when considered feasible, should be implemented as safely as possible."

The committee recommended that there should be three key priorities in the future: strengthening surveillance and achieving vaccination targets for at risk-groups; continuing to increase access to affordable therapeutics; and strengthening pandemic preparedness planning, while continuing to protect the most at-risk groups.

UNI/XINHUA PRT。

　一键部署OpenClaw

ThinkPHP是国内站长的老朋友，也是老漏洞的重灾区。5.x早期版本暴露过多次高危问题，比如远程代码执行、控制器任意调用。

B | 最坑的是很多站上线后没再更新过框架，漏洞一直躺在那儿。

自查第一步是确认版本。ThinkPHP 5.0.x/5.1.x低于特定小版本就要升级。先把composer.lock或者框架目录里的base.php版本号翻出来，再对照官方安全公告。 # 快速查看当前ThinkPHP版本 grep -r "VERSION" vendor/topthink/framework/src/think/App.php # 或者看composer.lock grep -A1 '"name": "topthink/framework"' composer.lock

自查第二步是限制后台入口。把admin、manage这些路径用Nginx做IP白名单或者加HTTP基本认证，别让搜索引擎随便扫到。同时关闭debug模式，runtime目录禁止执行脚本。 # Nginx中禁止访问敏感路径 location ~* ^/(application|extend|runtime|thinkphp|vendor)/ { deny all; } # 禁止执行上传目录里的PHP location ~* ^/upload/.*\.(php|php5|phtml)$ { deny all; }

最后一条容易被忽略：不要用默认的应用名和入口。