A lot of people in techny internet spaces online are talking about a PHP embargo. What does that mean and what’s going on?
Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.
That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.
Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Chainguard claims they had evidence of exploits being used in the wild. If that’s true breaking the embargo was the correct move. The embargo is only useful if the exploit isn’t in the wild.
Php is a programming language from the 90s that is still popular today but is kinda the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.
This has brought on a new round of bag punching.
Why’s it still popular?
Installing it and creating a “Hello world” page is easy and from there the sunk cost fallacy kicks in
It’s the backbone for a lot of other software, the Wordpress ecosystem most notably. Inertia is the big factor in terms of popularity.
Old school PHP was all about the LAMP stack (Linux as your operating system, apache as your web server, mysql as your database, php as the runtime apache would use to serve dynamic documents). The ecosystem was the real benefit that made it sensational for the era; all the pieces were designed to play nicely with one another.
It was also really noob friendly: You could write basic html, copy it to your web server, reload in browser, and see changes. Then to make things dynamic, you sprinkle in a few
The modern language is… serviceable, but lost the key features that made it great.
I love LAMP.
I like your differentiated explanation most
Because it works. Why spend the money to rewrite something in another language when the current one is working fine?
angry Rust noises in the distance
WordPress powers a huge percentage of all websites, and that’s written in PHP. MediaWiki is too, although that’s obviously a much smaller percentage.
Was a major vulnerability discovered?
Yep, two remote code execution rated at 9.2
The ratings seem to be overblown, however. This is nowhere near some of the vulnerabilities people have compared it to, like heartbleed or log4shell
The leaked info incorrectly called it a 10 so people are acting like a 10. But an unauthenticated RCE is always a big issue.
It’s an unauthenticated RCE in very specific circumstances under particular configurations. We haven’t even seen functional exploits in the wild yet.
edit: more info (albeit from a single researcher) here: https://eliastaylor.com/noexploit/
The fact that I haven’t heard of any major webservice involuntary taken over so far makes me increasingly skeptical, though I can also attribute it to preemptive action, partially. I presume an exploit chain might come in concert with some other insecure configurations or some malware developed eventually, but it wouldn’t be the first CVE with inflated scores in recent years.
The default Apache configuration*
Two were, yeah.
wait, didn’t the patches finish?
The patches were released yesterday, more than 24h ago. Originally they were supposed to be released today but some info leaked so they decided to step up the timetable.
Yeah. You had me worried.
Don’t worry. Everyone is just doing
sudo apt update sudo apt upgrade sudo shutdown -r nowJob done.
Oh and if you want to check your work.
r00ty@r00ted ~ $ php -v PHP x.x.x (cli) (built: Oct 21 2026 xx:xx:xx)Job definitely done.
Don’t even have to reboot. Just restart the PHP processes or the webserver.
Ah I mean apt update / apt upgrade is likely to upgrade other stuff too. So often I’ll reboot the whole server too. Depends on what else gets upgraded of course.
Good. Don’t want to lose my uptime
In simple terms, PHP is a language telling servers on the internet what to do. There is a problem with it, one that’s been known for a long time. But it wasn’t considered a major one because using this problem for hacking purposes was thought to be so much work nobody would use it.
Enter LLM agents. They have all the computing power in the world and time isn’t an issue. They used this vulnerability. And the internet panicked. Lots of smaller operations shut down as a precaution.
I think there is a patch in the works.Edit: Patches are out already.An embargo seems like a natural response to a threat like this. I’m not sure if it’s a good idea because I don’t know if you can just transition to using a different scripting language on any server. I understand it’s a fairly old language in internet terms. So it might be time to move on, I don’t know.Edit: I think I misunderstood the question. The embargo people talk about is more like the iPhone review embargo. The new iPhone gets released to reviewers ahead of public release so they can test and produce their pieces. And the embargo end day is when they can release their findings. The PHP embargo is, I think, the movers and shakers behind the scenes agreeing to shut up about the details of a vulnerability until the patch is out. If they go public before the patch then more bad actors get the blueprint on how to exploit the vulnerability.
I will take no follow-up questions because I had it explained to me like I’m a 5yo.
The patches have already been released yesterday.
Thanks for pointing that out. I have edited that part and one more.
It’s a nothing burger but every web dev is doing overhours cuz that one stakeholder said so.
