A lot of people in techny internet spaces online are talking about a PHP embargo. What does that mean and what’s going on?
There’s a bug. Update it.
Pretty simple, but apparently people have decided to lose their minds over this one.
To be fair, it’s quite a biggie.
not really, no
Actually yeah you’re right. I reread the post and their point was it wasn’t easily exploitable, not that it wasn’t exploitable. Which makes sense when LiveOverflow wasn’t able to bypass ASLR.
But the outcome of the exploit is bad enough to outweigh the difficulty. Even if it’s hard rce is something you don’t what to leave open.
i mean yeah, patch your stuff. but fact is there are no exploits available, because it only works on modified installs, and none of the pocs actually work in the wild.
Php is a programming language from the 90s that is still popular today but is kinda the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.
This has brought on a new round of bag punching.
Why’s it still popular?
It’s the English of programming languages. It’s a big ole cobbled-together mess that just happens to be useful in practice.
Installing it and creating a “Hello world” page is easy and from there the sunk cost fallacy kicks in
Yep. PHP stands for Perl Home Page. Perl is awful to debug and maintain.
One of these two statements are correct
I stand corrected:
PHP was originally an abbreviation of “Personal Home Page”, but it now stands for the recursive backronym “PHP: Hypertext Preprocessor”
P.S.: “One of these two statements *is correct.”
So close! In my defence, no posting before coffee is a good rule.
It’s the backbone for a lot of other software, the Wordpress ecosystem most notably. Inertia is the big factor in terms of popularity.
Old school PHP was all about the LAMP stack (Linux as your operating system, apache as your web server, mysql as your database, php as the runtime apache would use to serve dynamic documents). The ecosystem was the real benefit that made it sensational for the era; all the pieces were designed to play nicely with one another.
It was also really noob friendly: You could write basic html, copy it to your web server, reload in browser, and see changes. Then to make things dynamic, you sprinkle in a few
The modern language is… serviceable, but lost the key features that made it great.
I love LAMP.
I like your differentiated explanation most
Because it works. Why spend the money to rewrite something in another language when the current one is working fine?
That’s the problem with PHP. It’s quite easy to build something that works. It’s quite another to build something that works and is secure, scales well, is maintainable, etc. The thing is that ‘it works’ is something that people see immediately. Those other things they only get to experience when it’s too late.
This is compounded by the fact that because it’s so easy it attracts a lot of inexperienced developers who don’t even consider things like security. Add to that that the language is full of footguns.
That’s not to say it’s impossible to build good apps in PHP, but that is despite the language, not because of it. It takes experience, knowledge and discipline to write something secure and maintainable in PHP. Something a lot of PHP users don’t have.
angry Rust noises in the distance
Wait, you write web scripts in rust?
Lots of people write web sites in rust.
I don’t think it’s a great choice. But it does beat php.
Because it works.
As evident from this week troubles, no it doesn’t.
Yea it does. Every language has bugs, every program has bugs. The measure of a language is not does it have bugs its how does the governing body respond to problems.
You could have the best language, fast to run, fast to build, uses low resources, but I’d the governing body responds to bug reports saying “well don’t do it then” or “user error” its adoption is not likely to happen.
WordPress powers a huge percentage of all websites, and that’s written in PHP. MediaWiki is too, although that’s obviously a much smaller percentage.
Was a major vulnerability discovered?
Yep, two remote code execution rated at 9.2
The ratings seem to be overblown, however. This is nowhere near some of the vulnerabilities people have compared it to, like heartbleed or log4shell
The leaked info incorrectly called it a 10 so people are acting like a 10. But an unauthenticated RCE is always a big issue.
It’s an unauthenticated RCE in very specific circumstances under particular configurations. We haven’t even seen functional exploits in the wild yet.
edit: more info (albeit from a single researcher) here: https://eliastaylor.com/noexploit/
The fact that I haven’t heard of any major webservice involuntary taken over so far makes me increasingly skeptical, though I can also attribute it to preemptive action, partially. I presume an exploit chain might come in concert with some other insecure configurations or some malware developed eventually, but it wouldn’t be the first CVE with inflated scores in recent years.
The default Apache configuration*
Two were, yeah.
wait, didn’t the patches finish?
The patches were released yesterday, more than 24h ago. Originally they were supposed to be released today but some info leaked so they decided to step up the timetable.
Yeah. You had me worried.
Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.
That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.
Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Chainguard claims they had evidence of exploits being used in the wild. If that’s true breaking the embargo was the correct move. The embargo is only useful if the exploit isn’t in the wild.
Don’t worry. Everyone is just doing
sudo apt update sudo apt upgrade sudo shutdown -r nowJob done.
Oh and if you want to check your work.
r00ty@r00ted ~ $ php -v PHP x.x.x (cli) (built: Oct 21 2026 xx:xx:xx)Job definitely done.
You wanted to say, everyone in this field worth his salt had this automated and is ready for the regular cve appearance…
Well I meant also hobbyist server operators are just going to run those things, and get it done. Server farm operators definitely need automation, yes.
I disagree to a certain grade. If you have Internet facing services, this is not optional.
Eg automated security updates every night.
But what events like these always show is that even many professionals are doing it manually and amateurs partly never.
This is an observation.
Don’t even have to reboot. Just restart the PHP processes or the webserver.
Ah I mean apt update / apt upgrade is likely to upgrade other stuff too. So often I’ll reboot the whole server too. Depends on what else gets upgraded of course.
Good. Don’t want to lose my uptime
In simple terms, PHP is a language telling servers on the internet what to do. There is a problem with it, one that’s been known for a long time. But it wasn’t considered a major one because using this problem for hacking purposes was thought to be so much work nobody would use it.
Enter LLM agents. They have all the computing power in the world and time isn’t an issue. They used this vulnerability. And the internet panicked. Lots of smaller operations shut down as a precaution.
I think there is a patch in the works.Edit: Patches are out already.An embargo seems like a natural response to a threat like this. I’m not sure if it’s a good idea because I don’t know if you can just transition to using a different scripting language on any server. I understand it’s a fairly old language in internet terms. So it might be time to move on, I don’t know.Edit: I think I misunderstood the question. The embargo people talk about is more like the iPhone review embargo. The new iPhone gets released to reviewers ahead of public release so they can test and produce their pieces. And the embargo end day is when they can release their findings. The PHP embargo is, I think, the movers and shakers behind the scenes agreeing to shut up about the details of a vulnerability until the patch is out. If they go public before the patch then more bad actors get the blueprint on how to exploit the vulnerability.
I will take no follow-up questions because I had it explained to me like I’m a 5yo.
The patches have already been released yesterday.
Thanks for pointing that out. I have edited that part and one more.
It’s a nothing burger but every web dev is doing overhours cuz that one stakeholder said so.
