So its 3am, and we’re up patching servers. Sigh…
Why?
https://www.php.net/archive/2026.php#2026-10-21-5
“What the heck?”, “What is that?” I hear you say…
Heres the run-down:
72% of the worlds public facing internet uses the coding language PHP in some way shape or form under the hood. Whether the site runs wordpress, or joomla, or lots of other content management systems, chances are pretty high it runs on top of PHP. Normally bugs and vulnerabilities are found in the code of these tools that are used on top of PHP. Today, by emergency declaration, PHP – the base level language that these tools run on, has published a bug that requires urgent patching by system administrators. Impacted systems could be exploited to gain behind the scenes access to the server, and compromise it further. Cloudflare – a worldwide CDN has published that they first saw exploits of the bug 7 hours before the official patch was released…
This is a big deal. Think of it like Cadbury’s issuing a food recall notice on ALL of their chocolate that has been sold in the last 8+ years. You’ll have to go back to the shop and get the antidote for the chocolate flaw as fast as you can, and until you do, ideally no chocolate for you. Oh – and your baked goods with chocolate in them? Yeah – sorry… Without the antidote, we can’t say if you’ll get sick or not, but if you do, it’ll be a 9/10 bad…
Yay for people using AI, finding the bug, and making the world a safer place. Boo to people using AI to build exploits soo darn fast now that as soon as something is known to have a flaw, chances are there is someone actively exploiting it to try to undermine legitimate internet websites.
Because this is a flaw in the underlying fabric of soo much of the internet, we are right now seeing thousands of websites down while patches are put in place, or from people trying to take advantage of this. Whats worse? That includes the websites that people are trying to get those patches from! For example, we have a server that runs Ubuntu operating system, and the version of PHP on there requires installation from https://ppa.launchpadcontent.net/ – a major provider of versions of php. But that site is returning 503 status errors, and is effectively down – likely due to too many requests for its content – people hoping that the version of php they need updated has been released.
Some providers are handling this better than others. cPanel, a major website hosting tools provider, released patched versions of PHP compatible with their systems fairly fast, and forced them out to all servers running their software within an hour of the official patched versions becoming available. Why this is good, is that covers many small business websites which are hsoted on shared hosting (more than one businesses website per server, helping to lower the costs of having a website available to the public) without people needing to think about it. Other website infrastructure teams will have real issues as servers and software tools will need entirely rebuilt in order to cater for the updated code. That can be months worth of work (although we’d hope that web systems haven’t been left to get to that sort of state by their maintainers/investors!).
We will see more of these in the future. As AI is increasingly used in the security space, to find problems before malicious actors do, we will get all sorts of weird and wonderful exploits being published, and because computers can do things soo quickly now-a-days, people will need to increasingly act faster to patch and protect infrastructure. Which sucks for those who’s job it is to make that happen lol. Increasingly cyber security has moved to being a 24/7 monitored requirement, no longer can you suffice with a quick audit and fix what is found when you can prioritise it.
Need help ensuring your online assets are safe? I know some people who can help
