Comment by danso
8 hours ago
FWIW this is the most mainstream vulnerability in the new era where everyone has access to AI agents that have the potential capability to find and widely exploit the vulnerability far faster than the past timeframes for disclosure and patching.
I'm legitimately surprised half the hostnames on the internet isn't serving ClickFix or whatnot payloads already.
The average phpBB or Wordpress, even if it's behind cloudflare, probably has a direct IPv4 that's not disabled.
Giving me log4j vibes.
Much worse. Log4j was hard to exploit and worked only in specific condions. And it was bad. This is something else.
But log4j was also extremely painful to patch, since every application bundled the vulnerabile dependency.
This is a storm, but hopefully quick to blow over with a panic frency of apt update or docker build.
The immediate exposure is faar worse here though, since its by design internet facing code.
A college enabled logging on their server as soon as they saw the news, and got dozens of attempted requests against index.php.
log4j was indeed the last time the internet storm center went to threat level yellow (as it is today again)
I think some of the issues could have been avoided here, if they would not chase the PR and blog posts.
What's the "other way" that would be better in general?
The release should've been done sooner once it was clear the embargo was broken and people figured out the vulnerability.
Some issues covered here: https://thephp.foundation/blog/2026/10/21/todays-php-securit...
More proactive outreach and better coordination with key downstreams.