r/technology • u/barryshrug • 9h ago
Security ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/183
u/xX_420DemonLord69_Xx 8h ago
I noticed several small pirating websites went down yesterday. Separate sites for books, manga, and comics.
206
u/Evinceo 8h ago
Lots of sites went down on purpose to wait for the update. It's... real bad.
75
u/I_Am_Conjoined 8h ago
As a non developer that's the part that really signaled to me how serious this is
38
u/Leprecon 7h ago
Yeah it is a vulnerability which allows anyone to hijack a server remotely. And it is actively being shared online right now meaning anyone can get access to it. Not even on a secret darkweb hack selling site, but like twitter.
8
2
u/half-baked_axx 6h ago
Saved me from a tardy in my job today lol. Bamboohr took their website offline.
1
4
5
u/capnwinky 8h ago
Oh dang. What comic sites? You should share so we know which ones to avoid.
13
u/dankristy 7h ago
The sites that are (or were) down - were mostly down on purpose to wait for a fix they can apply.
4
2
543
u/0xdef1 9h ago
> You’ve read your last free article.
First and last, apparently.
94
u/SARB033 8h ago
Tangentially related. I was just trying to access a really old New York Times article, from the 1930s. They paywalled me. Insane they can do that for an article over 90 years old.
→ More replies (4)16
1
8h ago
[removed] — view removed comment
8
u/linuxwes 8h ago
Wow, Reddit removed my comment because it linked to a ublock filter list???
12
u/yawara25 8h ago
A lot of subreddits will have automod filters that remove (or put into an approval queue) anything containing direct links by default, for spam prevention.
172
u/tommyk1210 8h ago
We had clients calling today asking if we’d take our 20m+ user platform down…
You know it’s big when some random person in an SME knows about it.
441
u/zezoza 9h ago
PHP: used in more of 70% of websites worldwide.
ITT:
- I quit PHP before it was invented
- YEAH! I know. How could you have used that hot shit in the first place?
111
u/MakingItElsewhere 8h ago
Well, the alternative was to use Java, or .Net.
39
u/stray_r 8h ago
You could write cgi (common gateway interface) pages that PHP was designed to replace in C, C++ or Perl. All of these existed before PHP and early PHP implementations used the same CGI interface server side.
I've worked on cgi systems in C, PHP, Python, Java, Ruby and Haskell.
I'd recommend using the language specific web server modules where available as they leave much less room to introduce stupid site-level vulnerabilities.
I don't recommend using Haskell if you value your health or sanity.
Reddit was originally python and I was working on porting php a based social media platform to python at the time Reddit released the source code. That was an interesting scramble for my team to read a lot of code to see if there was anything we could plunder.
5
13
u/AndrewCoja 7h ago
Haskell should be illegal
10
u/Outrageous_Reach_695 7h ago
If someone says Haskell a third time, does it summon qn eldritch horror?
3
2
u/Pausbrak 4h ago
I actually think more programmers should play around with Haskell, precisely because it's so weird and out there. I spent a few weeks mucking about with it a decade ago and just that little exposure to pure functional programming gave me a lot of insight that I found very useful later on when map/reduce and similar operations became the next big thing in Java and C#.
I maintain it's too easy for software devs to get caught up in the same old patterns we're comfortable with if we just stick with the same old tools for everything. Learning as many different languages and programming styles as possible can really broaden our toolboxes even if we never actually use those languages for production.
Well, assuming people still have any interest in actually writing code, I guess. These days it seems like everyone just tells their AI agents to code everything so I guess it probably doesn't matter much anymore.
1
u/stray_r 3h ago
I understand your point, yes, programmers and computer scientists should explore different programming paradigms and I really like the lazy evaluation of Haskell.
However, Haskell is incredibly information dense and difficult to understand. I don't care how beautiful and elegant or even performant someone's 4 lines of Haskell are if it can't be easily read and understood.
I'd much rather have a page of python that is well understood by everyone who might need to work on it because easy to understand code generates less bugs when your most stupid team member does a quick modification under pressure.
And your most stupid team member is often future you dealing with a situation you didn't plan for whilst deprived of sleep and caffeine and under pressure to have finished an hour ago because time is money.
From my own bitter experience there is nothing worse than trying to read back in to a Haskell project, the cognitive load of understanding the incredibly dense code is really high compared to almost anything else that might be task appropriate.
2
u/Pausbrak 3h ago
I understand where you're coming from, and I'm not really trying to disagree with you. Not every language is good for production code, and as interesting as Haskell is intellectually I can imagine it's a pain in the ass to use for real software for exactly the reasons you mention.
I only wanted to share that I found learning it has been indirectly useful for me in getting better at programming with other languages. In general, I mostly make use of the skills I learned when I'm writing LINQ queries or Java Streams.
Funnily enough, I think getting more comfortable working with Haskell and similar functional approaches was exactly what has helped me get better at writing more readable and comprehensible LINQ queries. For instance, it's tempting to just stuff all the logic in a giant unreadable Select() lambda, but it's definitely easier on the eyes and brain when you chain a bunch of standard functions together instead.
1
u/stray_r 2h ago
I think Haskell gave me some very particular headaches. I was trying to figure out ways to deal with things the language doesn't do very well and mostly I discovered why that was.
Absolutely you should look at different perspectives and paradigms, but I think ultimately that code is read a lot more than it is written and the best code is not concise code or elegant code, it's easy to read, understand and maintain code.
And staying on today's topic, code that is secure by design is good code. A lot of my C probably wasn't and I'm so glad none of the CGI I worked on in C is still in the wild.
I don't actually know how vulnerable to attack Haskell projects are, it's so rare to use Haskell in anything web facing.
No. Don't go there Stray. Down this path lies madness. And Eldrich horrors.
1
u/lars_jeppesen 5h ago
CGI scripts were the devil. Horrible horrible
1
u/stray_r 3h ago
They were the only way to do interactive web at the time. Trying to do CGI in C or similar to get reasonably performance and serve a decent number of clients without falling over.
... I'm trying to think what I was even using back then... I think a 100Mhz Pentium Pro, can't remember how much ram it didn't have... And then a dual 400MHz Pentium 2 with 384Mb of ram, 5x 9Gb SCSI drives and an ILO bigger than a modern gaming graphics card...
Winning the argument for mod_php on apache because more hardware was cheaper than more developers and we could get more janky shit done faster with php than anything else at the time was a step forward. It was the future a quarter century ago.
And you have to remember that when bulletin boards like phpBB happened, they didn't distribute mods and upgrades as something you could apply with patch or a git pull, there was no git then. You had to hand patch phpBB, it was the stuff of nightmares but everyone wanted their own customised build of it.
I miss independent bulletin boards. I don't miss the maintenance.
1
u/TacoIncoming 36m ago
You could write cgi (common gateway interface) pages that PHP was designed to replace in C, C++ or Perl.
Because there’s no way that could go tits up 🤣
1
u/stray_r 11m ago
In the 90s there was much more opposition to scripting languages and much more do it in C because that's how we've always done it
The janky script for Personal Home Pages that runs a crazy amount of the web was a huge step forward.
I know what the onslaught of privative automated attacks on my servers did ~25 years ago. I dread to think what modern AI exploits would do to the janky C I was running in the 90s.
22
u/zezoza 8h ago
My whole company runs on 25 years of spaghetti JSP code
11
u/x_Trassic_x 8h ago
It'll take AI years to unravel that
7
u/peduxe 7h ago
Anthropic and OpenAI might just flag your account for suspicious activity trying to throw their models at a JSP codebase.
8
u/MakingItElsewhere 7h ago
"Why are the servers on fire?" "Someone asked them to look at their JSP, and they chose seppuku instead."
8
u/KagakuNinja 8h ago
Java JSP was equivalent to PHP. There was a bit more verbosity but nowhere near as bad as everyone seems to think. I once had to port some features from a PHP game to a Java game, and it was just a 1 for 1 translation to the JSP.
Java was built by professionals, with at least attempts at security and multi threading from day 1. PHP has been playing catchup for decades, it isn't at all surprising to see that a dumpster fire of a language is also insecure.
PHP was designed to be easy to get started, with pre configured LAMP distros. The extra ceremony of Java seems like a pain in the ass, until you suddenly need to do things like support multiple versions of the runtime, which is trivial with Java.
5
u/DoxxThis1 7h ago edited 33m ago
PHP wasn’t designed, it just evolved, like an brain-eating bacteria
1
u/npsimons 6h ago
PHP is the most ad hoc programming language, ever. Oh yeah, you'll hear its defenders say "such and such hasn't been an issue since X.Y.Z", but the fact is that all these problems are indicative of a deeper rot within the language itself.
We dumped bind because it was full of security holes, we dumped sendmail because it was full of security holes. Both of those were incredibly popular, yet the Internet managed to move on from them. PHP is just another legacy project that should stop being used.
You know all those vibecoders putting out massive steaming turds? It's the same mindset of PHP, "oh, it's easier, I don't have to learn anything!"
3
1
→ More replies (1)1
u/Own_Reaction9442 2h ago
Before PHP, we used Perl to do CGI websites. Perl's syntax is based heavily on Perl's.
Before that it was a bunch of different stuff; TCL was fairly popular at one point.
5
u/Vimda 8h ago
Ok, but how much of that 70% is Facebook and Wordpress installations?
16
u/dangerbird2 7h ago
Presumably Facebook isn't really affected since they run on HHVM (which doesn't even support non-Hack PHP anymore). Wordpress is a completely different story due to the bazillion mom and pop websites that are definitely not getting security patches before some webcrawler finds and exploits it.
2
u/pathwalker1991 6h ago
I feel like these kinda sites are gonna need to be forced offline by Wordpress hosts or something, to protect their own internal servers. They’re not all going to take them down and patch, or possibly even know there’s an issue. Unless there’s a way for it to be pushed through. (Not a Wordpress person, so not 100% on the particulars)
1
115
105
u/SPEZ_IS_A_JABRONI 8h ago
the internet feels like it's been on fire for a while now
75
10
u/lazypeon19 4h ago
Welcome to post-AI internet.
4
40
u/MisandristBPDBarby 3h ago
This is gonna kill old forums
14
u/SpelingChampion 1h ago
The massive old repository of human experience and process? Of course it would consume and destroy it.
29
u/DeepBreathingWorks 3h ago
Why not just re-write it in Rust? I hear that solves everything.
1
u/bakaspore 4m ago
Practicality aside this would indeed solve the use after free problem leading to this issue...
32
u/subnub_dev 7h ago
God I'm trying to launch my own website and this all just seems like a nightmare. I already had someone exploit an outdated next.js package.
Idk how I can keep up
16
u/ThetotheM 6h ago
Use Renovate to keep track of your dependencies and take care of PRs regularly. Also, follow a newsticker for this stuff. This will take care of most of these incidents.
→ More replies (3)2
u/WastedPotenti4I 1h ago
If you’re using JavaScript most package managers (npm, pnpm, bun im pretty sure), have an audit feature that tells you if any vulnerabilities have been found.
13
u/ChillyFireball 3h ago
My condolences to my fellow web developers who use PHP. Alas, I will soon be departing the office to go home and play video games. Good luck with the late night(s), software soldiers! I salute you!
20
u/Odd_Beginning8678 7h ago
So that's why many websites are down today. Right now I'm stuck at trying to access a file I need.
52
u/Isthatyourfinger 3h ago
This is going to be a huge problem. Aside from finding people to fix the code, a lot of them are going to find that the new release of PHP no longer works with their obsolete db drivers. I would love to come out of retirement and fix these issues, but old people will never make it past the AI resume screeners. Younger programmers will want to rewrite it in the their favorite language, and enter a world of pain.
28
u/tommyk1210 3h ago
It’s not.
They’ve already created backports of this fix to basically every version of PHP since 5.4
You don’t NEED latest and greatest major version benefit from this fix because the issue has been present in the fundamentals of PHP for 20 years
5
10
u/Isthatyourfinger 2h ago
Cool. So all they have to do is recompile. Oops, nobody documented the compiler switches used? You can get the executable to spit them out, but they don't work anymore anyway because the o/s no longer supplies the object file needed for the feature? And no production tests were ever written and the coder is long dead? Good luck my friend.
8
u/PabloCIV 1h ago
I get you’re trying to make a point here, but AI is currently at a level where this is all made pretty trivial.
3
u/PossibleHero 25m ago
Exactly, people will hate this comment. But I bet most models above Sonnet 5.5 can handle this in one shot in most moderately sized codebases.
8
u/correctingStupid 1h ago
Nope. 15 minute update. Happened across half the web in a matter of hours this morning.
5
u/Droidaphone 1h ago
Y’know what, I was gonna disagree but you might be right. From this USAToday article:
Cybersecurity firm Cisco Talo estimates that about 50% of all PHP systems around the world will not receive an official patch for the newly discovered security issues because older websites rely on unsupported versions of PHP, so there is no easy way for them to be updated.
3
u/whyliepornaccount 19m ago
To those who don't work in tech, this is shocking. To those who work in tech, this is shocking that the number isn't higher.
Those older websites relying on unsupported versions are exactly that: older websites. Any modern website more likely than not has PHP that is patchable. A large portion of the modern websites still using PHP are WordPress based websites. WordPress runs supported versions of PHP.
7
3
2
2
u/Possible_Ground_9686 1h ago
Most sites already fixed it so you can stay in retirement. Cool comment though 👍
3
u/Fuck-WestJet 56m ago
Competely inaccurate. I assume you don't actually work in web dev and are quite ignorant.
1
1
u/Shot-Possibility-399 1h ago
I mean I've been hearing this about legacy code systems for years. I know ai isn't perfect but I imagine it would help with the translation issue a bit?
1
5
u/NoStrategy1419 3h ago
Wait so is my phpbb forum safe? I'm not going to get spam am I...? I haven't updated it since 2003.
18
u/ArcanumAntares 5h ago
So, hol'up. You're telling me my WP build shouldn't use 'admin' for the administrative un? /s
Patching PHP may as well be it's own career in 2026.
15
6
14
u/sircastor 8h ago
I still use Wordpress for my personal site, but I’ve taken it off the internet. It lives on my home server, generates a static site, and uploads to my host.
In another life I was a PHP developer. It’s been a long time though.
3
u/grat_is_not_nice 5h ago
I disabled port forwarding for http/https on the router to isolate my home lab services until everything is patched.
6
2
9h ago
[deleted]
45
26
22
u/w1n5t0nM1k3y 9h ago
WordPress uses PHP and WordPress still runs a large number of websites around the world.
4
u/Default_Sock_Issue 8h ago
Unfortunately
6
u/SPEZ_IS_A_JABRONI 8h ago
Wordpress is a perfectly reasonable platform to run a website with if you keep it patched, like any application.
The problem is that many users install tons of third party plugins which go unpatched, which then snowball and create conflicts with core causing users to leave core unpatched.
7
u/DefenestrationPraha 8h ago
PHP now is not PHP 16 years ago. I am 48, I saw the development. It just isn't the same language.
3
u/cute_polarbear 8h ago
yeah. problem is this affects PHP version 5 (>20 years ago) and on...many sites (internal / external) likely still running on very old versions of PHP, and no easy upgrade path in short term...
→ More replies (10)3
1
1
1
u/WalkFirm 31m ago
Perhaps these executives will wake the frack up. Cyber security is not a technology problem it’s a business problem. They don’t want to invest and yet most of their business is completely reliant on technology.
1
1
0
u/butter_lover 3h ago
True story: couple years back the f500 that I was working for decided to refactor the main website using a product based on PHP and also migrate to their hosting.
When this was told to me, I scoffed and said something about us not really keeping up with patches for the current platform I wonder how they’re gonna manage a treadmill.
They blew me off then but now I have the last word at last hahahahajah
1.9k
u/omniuni 8h ago
It's worth noting that PHP is still one of the best tested codebases. However bad this is, PHP isn't going to be the only web language experiencing these kinds of vulnerabilities as AI runs every language through the wringer.