A lot of people in techny internet spaces online are talking about a PHP embargo. What does that mean and what’s going on?
There’s a bug. Update it.
Pretty simple, but apparently people have decided to lose their minds over this one.
What's going on with PHP?
Submitted 23 hours ago by tottle@lemmy.ca to [deleted]
Comments
ikidd@lemmy.dbzer0.com 14 hours ago
KingThrillgore@lemmy.ml 4 hours ago
People get irrationally angry when PHP has a fault. Must be because we’re too busy holding up 70% of the web to fall for drama.
In all seriousness these exploits are bad. Update right away.
NeatNit@discuss.tchncs.de 13 hours ago
To be fair, it’s quite a biggie.
corsicanguppy@lemmy.ca 4 hours ago
To be fair, it’s quite a biggie.
I remember a day when we had 4 major ssh Vulnerabilities in the same day. We were on advance notice because #OSVendor so we got them as they came in and went nuts.
And each one that came in spawned another new effort of research, patch, test, roll, systest, releng, ship. It was all day, all-hands, every group, panic.
Wait. Now I can’t decide whether it was 2002 or 2003, because there were 2 days where that fucking happened.
With openssh.
Keep your pants on, right?
ikidd@lemmy.dbzer0.com 5 hours ago
None of the POCs work and it’s not an issue in a fresh install.
cman6@lemmy.world 21 hours ago
Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.
That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.
somehacker@lemmy.world 21 hours ago
Chainguard claims they had evidence of exploits being used in the wild. If that’s true breaking the embargo was the correct move. The embargo is only useful if the exploit isn’t in the wild.
tjoa@feddit.org 22 hours ago
It’s a nothing burger but every web dev is doing overhours cuz that one stakeholder said so.
slazer2au@lemmy.world 23 hours ago
Php is a programming language from the 90s that is still popular today but is kinds the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.
This has brought on a new round of bag punching.
phoenixz@lemmy.ca 5 hours ago
Because as we all know, other computer languages never have had any vulnerabilities, ever
slazer2au@lemmy.world 5 hours ago
I haven’t heard of Rockstar having one. Go become a certified rockstar dev and confuse recruits.
florge@feddit.uk 23 hours ago
Why’s it still popular?
dgdft@lemmy.world 23 hours ago
It’s the backbone for a lot of other software, the Wordpress ecosystem most notably. Inertia is the big factor in terms of popularity.
Old school PHP was all about the LAMP stack (Linux as your operating system, apache as your web server, mysql as your database, php as the runtime apache would use to serve dynamic documents). The ecosystem was the real benefit that made it sensational for the era; all the pieces were designed to play nicely with one another.
It was also really noob friendly: You could write basic html, copy it to your web server, reload in browser, and see changes. Then to make things dynamic, you sprinkle in a few
<?php ?>tags in your html, copy it to the server, and it starts working! The code inside those php tags gets run by the web server and their output is written into the HTML. No reloading or resetting apache needed, and you need very little programming knowledge to start.The modern language is… serviceable, but lost the key features that made it great.
executivechimp@discuss.tchncs.de 13 hours ago
It’s the English of programming languages. It’s a big ole cobbled-together mess that just happens to be useful in practice.
slazer2au@lemmy.world 23 hours ago
Because it works. Why spend the money to rewrite something in another language when the current one is working fine?
bravesirrbn@lemmy.world 19 hours ago
Installing it and creating a “Hello world” page is easy and from there the sunk cost fallacy kicks in
schnurrito@discuss.tchncs.de 23 hours ago
WordPress powers a huge percentage of all websites, and that’s written in PHP. MediaWiki is too, although that’s obviously a much smaller percentage.
tottle@lemmy.ca 23 hours ago
Was a major vulnerability discovered?
slazer2au@lemmy.world 23 hours ago
Yep, two remote code execution rated at 9.2
www.php.net/archive/2026.php#2026-10-20-1
TheButtonJustSpins@infosec.pub 23 hours ago
Two were, yeah.
Skullgrid@lemmy.world 22 hours ago
wait, didn’t the patches finish?
bjoern_tantau@swg-empire.de 21 hours ago
The patches were released yesterday, more than 24h ago. Originally they were supposed to be released today but some info leaked so they decided to stel up the timetable.