Php is a programming language from the 90s that is still popular today but is kinda the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.
This has brought on a new round of bag punching.
Because as we all know, other computer languages never have had any vulnerabilities, ever
I haven't heard of Rockstar having one. Go become a certified rockstar dev and confuse recruits.
Tommy used to work on the docs
Why's it still popular?
It's very fast to load in the browser and lightweight in the backend too, without sacrificing much functionality except for some fancy animations.
Personally I just hate the language syntax though 😅
It’s the backbone for a lot of other software, the Wordpress ecosystem most notably. Inertia is the big factor in terms of popularity.
Old school PHP was all about the LAMP stack (Linux as your operating system, apache as your web server, mysql as your database, php as the runtime apache would use to serve dynamic documents). The ecosystem was the real benefit that made it sensational for the era; all the pieces were designed to play nicely with one another.
It was also really noob friendly: You could write basic html, copy it to your web server, reload in browser, and see changes. Then to make things dynamic, you sprinkle in a few <?php ?> tags in your html, copy it to the server, and it starts working! The code inside those php tags gets run by the web server and their output is written into the HTML. No reloading or resetting apache needed, and you need very little programming knowledge to start.
The modern language is… serviceable, but lost the key features that made it great.
I love LAMP.
I like your differentiated explanation most
It's the English of programming languages. It's a big ole cobbled-together mess that just happens to be useful in practice.
Because it works. Why spend the money to rewrite something in another language when the current one is working fine?
angry Rust noises in the distance
Wait, you write web scripts in rust?
Lots of people write web sites in rust.
I don't think it's a great choice. But it does beat php.
That’s the problem with PHP. It’s quite easy to build something that works. It’s quite another to build something that works and is secure, scales well, is maintainable, etc. The thing is that ‘it works’ is something that people see immediately. Those other things they only get to experience when it’s too late.
This is compounded by the fact that because it’s so easy it attracts a lot of inexperienced developers who don’t even consider things like security. Add to that that the language is full of footguns.
That’s not to say it’s impossible to build good apps in PHP, but that is despite the language, not because of it. It takes experience, knowledge and discipline to write something secure and maintainable in PHP. Something a lot of PHP users don’t have.
Most of the main issue here where standard SQL practices were hugely insecure went by the wayside over a decade ago and the other issues are common to all internet work. PHP got to carry that heritage though.
But like, I’ve seen early work from a guy now making huge bucks with nvidia on their streaming side where I hacked it within minutes because he just didn’t know that you can’t do security with front end JavaScript.
Installing it and creating a "Hello world" page is easy and from there the sunk cost fallacy kicks in
WordPress powers a huge percentage of all websites, and that's written in PHP. MediaWiki is too, although that's obviously a much smaller percentage.
Was a major vulnerability discovered?
Yep, two remote code execution rated at 9.2
The ratings seem to be overblown, however. This is nowhere near some of the vulnerabilities people have compared it to, like heartbleed or log4shell
The leaked info incorrectly called it a 10 so people are acting like a 10. But an unauthenticated RCE is always a big issue.
It's an unauthenticated RCE in very specific circumstances under particular configurations. We haven't even seen functional exploits in the wild yet.
edit: more info (albeit from a single researcher) here: https://eliastaylor.com/noexploit/
Two were, yeah.
There's a bug. Update it.
Pretty simple, but apparently people have decided to lose their minds over this one.
People get irrationally angry when PHP has a fault. Must be because we're too busy holding up 70% of the web to fall for drama.
In all seriousness these exploits are bad. Update right away.
To be fair, it's quite a biggie.
To be fair, it's quite a biggie.
I remember a day when we had 4 major ssh Vulnerabilities in the same day. We were on advance notice because #OSVendor so we got them as they came in and went nuts.
And each one that came in spawned another new effort of research, patch, test, roll, systest, releng, ship. It was all day, all-hands, every group, panic.
Wait. Now I can't decide whether it was 2002 or 2003, because there were 2 days where that fucking happened.
With openssh.
Keep your pants on, right?
But the outcome of the exploit is bad enough to outweigh the difficulty. Even if it's hard rce is something you don't what to leave open.
i mean yeah, patch your stuff. but fact is there are no exploits available, because it only works on modified installs, and none of the pocs actually work in the wild.
not really, no
Actually yeah you're right. I reread the post and their point was it wasn't easily exploitable, not that it wasn't exploitable. Which makes sense when LiveOverflow wasn't able to bypass ASLR.
None of the POCs work and it's not an issue in a fresh install.
No TV And No Beer Make Homer Go Crazy
Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.
That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.
Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Chainguard claims they had evidence of exploits being used in the wild. If that’s true breaking the embargo was the correct move. The embargo is only useful if the exploit isn’t in the wild.
Don't worry. Everyone is just doing
sudo apt update
sudo apt upgrade
sudo shutdown -r now
Job done.
Oh and if you want to check your work.
r00ty@r00ted ~ $ php -v
PHP x.x.x (cli) (built: Oct 21 2026 xx:xx:xx)
Job definitely done.
Don't even have to reboot. Just restart the PHP processes or the webserver.
Ah I mean apt update / apt upgrade is likely to upgrade other stuff too. So often I'll reboot the whole server too. Depends on what else gets upgraded of course.
In simple terms, PHP is a language telling servers on the internet what to do. There is a problem with it, one that's been known for a long time. But it wasn't considered a major one because using this problem for hacking purposes was thought to be so much work nobody would use it.
Enter LLM agents. They have all the computing power in the world and time isn't an issue. They used this vulnerability. And the internet panicked. Lots of smaller operations shut down as a precaution. ~~I think there is a patch in the works.~~ Edit: Patches are out already.
~~An embargo seems like a natural response to a threat like this. I'm not sure if it's a good idea because I don't know if you can just transition to using a different scripting language on any server. I understand it's a fairly old language in internet terms. So it might be time to move on, I don't know.~~
Edit: I think I misunderstood the question. The embargo people talk about is more like the iPhone review embargo. The new iPhone gets released to reviewers ahead of public release so they can test and produce their pieces. And the embargo end day is when they can release their findings. The PHP embargo is, I think, the movers and shakers behind the scenes agreeing to shut up about the details of a vulnerability until the patch is out. If they go public before the patch then more bad actors get the blueprint on how to exploit the vulnerability.
I will take no follow-up questions because I had it explained to me like I'm a 5yo.
The patches have already been released yesterday.
!nostupidquestions is a community dedicated to being helpful and answering each others' questions on various topics.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rule 1- All posts must be legitimate questions. All post titles must include a question.
All posts must be legitimate questions, and all post titles must include a question. Questions that are joke or trolling questions, memes, song lyrics as title, etc. are not allowed here. See Rule 6 for all exceptions.
Rule 2- Your question subject cannot be illegal or NSFW material.
Your question subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Questions which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding META posts and joke questions.
Provided it is about the community itself, you may post non-question posts using the [META] tag on your post title.
On fridays, you are allowed to post meme and troll questions, on the condition that it's in text format only, and conforms with our other rules. These posts MUST include the [NSQ Friday] tag in their title.
If you post a serious question on friday and are looking only for legitimate answers, then please include the [Serious] tag on your post. Irrelevant replies will then be removed by moderators.
Rule 7- You can't intentionally annoy, mock, or harass other members.
If you intentionally annoy, mock, harass, or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here. This includes using AI responses and summaries.
Our breathtaking icon was bestowed upon us by @Cevilia!
The greatest banner of all time: by @TheOneWithTheHair!