New PHP vulnerability means the Internet will have a very rough couple of days

[u/Radio_TVGuy]

https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days

[u/BufferUnderpants]

First time I've seen Wikipedia down.

The article doesn't give many details, but this is a pair of memory-related remote code execution vulnerabilities, there are fixes for PHP 8 but it's not clear to me if it's only PHP 8 that's affected.

https://github.com/NCSC-NL/php2shell

[u/pissingtoxicspores → u/BufferUnderpants]

I'm like, a normal person on the internet, is this like a "go offline for 2-3 days" type of thing? Do I need to update all my passwords everywhere? How do I know what websites are safe or not?

[u/super_aardvark → u/pissingtoxicspores]

The vulnerability isn't a risk to you directly. Any site that's down right now is doing the right thing, and you can probably trust them once they come back up. Plenty of sites are completely unaffected by the vulnerability (because they don't use PHP), so no problem there.

If any sites do use PHP and don't go down at all during this, there's a chance they could be hacked. Unfortunately, it's tough for a layman to tell these sites apart from the ones that don't use PHP.

If a site is compromised, then the risk to you depends on what the hacker wants to do (no fundamental difference from past website hacks). Publishing your username and password for the compromised site, or other data the site has about you, is the most common thing that could affect you. The strength of your password would determine how quickly it gets published (if at all), and if you're using the same password on other sites then that would be bad.

I don't think there's any reason to go offline for 2-3 days. Maybe avoid entering your credit card on small mom-and-pop e-commerce sites. (Do those exist?) Anyone with a half-competent IT department knows about this and is taking it seriously.