Comment by nr378
20 hours ago
Given that this affects every PHP version from the past decade, and that the exploit instructions are circulating at the top of twitter, and that there's no fix available yet, it doesn't seem outrageous to assume every major PHP website is already compromised?
The upgrade instructions here should include torching your hosts and starting again.
I would assume that in many (smaller, non-professional) systems/code bases, it is also possible to poison the backups and code base in general. This would have been a major effort in the pre-LLM age, but it should be pretty easy now. As soon as such instructions are out there, people (or rather LLMs) are going to find ways to make the threat persist.
It's time to have the conversation about killing PHP again.
We don't really need it anymore now that we have LLMs.
People love hating on PHP. But Go has CVEs like every week, and people are getting tired of updating it. I don't think there is a fundamental "PHP bad" argument beyond just "hating on it". While Go/Node have grown much more than PHP, PHP is definitely alive.
12 replies →
The conversation should be about having more variety in structural components, not less: if you kill php and everyone starts using Go for example, the next CVE found in Go will impact as much. The real way is to have more widespread ecosystems.
1 reply →
I don't understand why PHP is redundant now that we have llms?
4 replies →
Yes. Even if you are not running PHP yourself, you should now prepare for:
- Any PHP site you ever put your email/password/personal data in being hacked over the next few hours (especially things like forums).
- As a result of the above, a massive wave of phishing attempts.
- Corporates/Admins panicking and turning off services as a precautionary measure over the next hours or days.
That's not panicking.
What else do you expect them to do? Pray?
Switching something off is far preferably over being hacked.
Agree, I think switching off any running PHP services *at the power socket* is a pretty rational response at this point.
It's not really panicking when CERT-EU is literally suggesting this (in the comment text of this story)
Sure, im referring to systems being turned off even if they are not running PHP at all. Out of fear of spillover effects or because they are unsure what they are running.
It’s probably advisable to go through your password manager and start deleting any accounts you no longer use. And of course make sure that you have zero shared passwords