r/technology • u/Radio_TVGuy • 12h ago

Security New PHP vulnerability means the Internet will have a very rough couple of days

https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days
2.7k Upvotes

98% Upvoted

287 comments sorted by

View all comments

319

u/MaxRD 11h ago

Couple of months, more likely. The vast majority of exposed and vulnerable sites are managed by people who will not be aware of it until after they get compromised

7

u/lilB0bbyTables 3h ago

Even the ones that are aware are going to have struggles. The patches will only be applied to latest PHP version … plenty of old sites are running older PHP 5 - 7 and have done so because the cost/effort to migrate is expensive. If they want to mitigate these vulnerabilities they are going to need to migrate, which means going in and updating a bunch of dependencies, running all their tests and/or manual smoke testing, fixing all the inevitably broken stuff, then rolling out those deployments. For many folks and teams, that could take days/weeks which leaves them sitting ducks unless they have the liberty of taking their software offline.

3

u/ToiletSeatFoamRoller 2h ago

Yeah we’re relying hard on the virtual host memory options and Cloudflare to protect us in the meantime. It’s been a scary day making sure that’s all airgapped (as much as it can be). Yes I’ve been shouting from the rooftops for two years that something like this was going to happen, now they have to prioritize it.

3

u/lilB0bbyTables 2h ago

Stakeholders/management failing to grasp the financial risks associated with not paying down technical debt - the tale as old as time. Rather than paying it off up front, or even a little at a time, now they get to pay it with interest.

At every org I have worked for, I have kept an internal wiki page dedicated to aggregating a list of technical debt that I was aware of (and encouraged others to co tribute to that page). I always keep a nice table along with it to identify each item in a row alongside a column giving a rough estimate on effort to address it and another assessing the overall risk associated with it. I have found that other folks appreciated it and more importantly, it has proven to be effective in getting green lights to schedule it into sprints to go ahead and pay some of it off iteratively.

1

u/ToiletSeatFoamRoller 16m ago

Love this idea, beats the hell out of // TODO everywhere. I’ll throw jira tasks in the backlog for ones I really don’t want to forget about but I think the wiki has more presentation potential

2

u/enigmamonkey 36m ago

The patches will only be applied to latest PHP version

The good news here is that there are two routes you can take for this: PHP's security team provided official backports even for older EOL (normally unsupported) versions, including PHP 7.4, PHP 8.0, and PHP 8.1.

There's even an unofficial repo that provides backports going all the way back to PHP 5.0 (which is insane) and it looks like they include fixes for the latest CVE-2026-109618 and CVE-2026-109619 (but double check for yourself before taking my word for it). See: https://github.com/shivammathur/php-src-backports