Given that this affects every PHP version from the past decade, and that the exploit instructions are circulating at the top of twitter, and that there's no fix available yet, it doesn't seem outrageous to assume every major PHP website is already compromised?

The upgrade instructions here should include torching your hosts and starting again.

▲

juliusjh 3 hours ago | parent | next [-]

I would assume that in many (smaller, non-professional) systems/code bases, it is also possible to poison the backups and code base in general. This would have been a major effort in the pre-LLM age, but it should be pretty easy now. As soon as such instructions are out there, people (or rather LLMs) are going to find ways to make the threat persist.

▲

echelon 2 hours ago | parent [-]

It's time to have the conversation about killing PHP again.

We don't really need it anymore now that we have LLMs.

▲

owenthejumper 2 hours ago | parent | next [-]

People love hating on PHP. But Go has CVEs like every week, and people are getting tired of updating it. I don't think there is a fundamental "PHP bad" argument beyond just "hating on it". While Go/Node have grown much more than PHP, PHP is definitely alive.

▲

kllrnohj 22 minutes ago | parent | next [-]

> While Go/Node have grown much more than PHP, PHP is definitely alive.

PHP still powers approximately 70% of websites

▲

echelon an hour ago | parent | prev [-]

Replace it all with Rust. It's a fantastic server language.

Nobody needs to write any of this code anymore.

Rust is literally the best positioned language to handle the upcoming onslaught of CVEs.

	▲	traceroute66 21 minutes ago \| parent [-]
		> Rust is literally the best positioned language to handle the upcoming onslaught of CVEs. Rust is also a language with no real stdlib, and so you have to import crates for everything including the kitchen sink. Which opens you up to the very real risk of supply chain vulnerabilities unless you make an active effort to code review your imports and keep the length of your import list under control.[1][2][3] Rust supporters also need to urgently realise that memory safe != secure. It is very much possible to have vulnerabilities in memory safe code. This has been demonstrated by Cloudflare[4] and countless others. Age-old vulnerability classes such as input validation, error handling and many others are still very much possible in a Rust codebase. So please. Yes, I'm sure Rust is a fantastic memory-safe language. But do not portray it as being magically immune from CVEs. [1] https://kerkour.com/rust-supply-chain-nightmare [2] https://tweedegolf.nl/en/blog/119/sudo-rs-depencencies-when-... [3] https://tweedegolf.nl/en/blog/104/dealing-with-dependencies-... [4] https://hackaday.com/2025/11/20/how-one-uncaught-rust-except...

▲

bilekas an hour ago | parent | prev [-]

I don't understand why PHP is redundant now that we have llms?

	▲	juliusjh an hour ago \| parent [-]
		Not the one you are replying to, but an argument I heard is that 1) It is now much easier to work in a language with better security features such as Rust. Previously, there definitely was some kind of trade-off between accessibility, performance, and security, and some people argue that this is over. I don't know if this is true, but it seems plausible. 2) You can now translate your legacy projects to a different language much more easily. This is definitely true, but that doesn't mean it doesn't introduce new/other problems or that it is easy enough (again, I simply don't know).

▲

sparkling 3 hours ago | parent | prev [-]

Yes. Even if you are not running PHP yourself, you should now prepare for:

- Any PHP site you ever put your email/password/personal data in being hacked over the next few hours (especially things like forums).

- As a result of the above, a massive wave of phishing attempts.

- Corporates/Admins panicking and turning off services as a precautionary measure over the next hours or days.

▲

jacquesm 2 hours ago | parent | next [-]

That's not panicking.

What else do you expect them to do? Pray?

Switching something off is far preferably over being hacked.

	▲	nr378 2 hours ago \| parent [-]
		Agree, I think switching off any running PHP services at the power socket is a pretty rational response at this point.

▲

thombles 3 hours ago | parent | prev | next [-]

It's not really panicking when CERT-EU is literally suggesting this (in the comment text of this story)

	▲	sparkling 3 hours ago \| parent [-]
		Sure, im referring to systems being turned off even if they are not running PHP at all. Out of fear of spillover effects or because they are unsure what they are running.

▲

Gigachad 3 hours ago | parent | prev [-]

It’s probably advisable to go through your password manager and start deleting any accounts you no longer use. And of course make sure that you have zero shared passwords