This is obviously bad, but in my 20 years of hosting with PHP, I've never had to take the steps of taking down servers preemptively. It's not good, but honestly, and I think the way this was handled could leave a lot to be desired, I think this might be the "worst" we've had with PHP, and it took a while to get here.

▲

danso 4 hours ago | parent | next [-]

FWIW this is the most mainstream vulnerability in the new era where everyone has access to AI agents that have the potential capability to find and widely exploit the vulnerability far faster than the past timeframes for disclosure and patching.

▲

dannyw 3 hours ago | parent | next [-]

I'm legitimately surprised half the hostnames on the internet isn't serving ClickFix or whatnot payloads already.

The average phpBB or Wordpress, even if it's behind cloudflare, probably has a direct IPv4 that's not disabled.

▲

aDyslecticCrow an hour ago | parent | prev | next [-]

Giving me log4j vibes.

	▲	Neikius 20 minutes ago \| parent [-]
		Much worse. Log4j was hard to exploit and worked only in specific condions. And it was bad. This is something else.

▲

nicce 4 hours ago | parent | prev [-]

I think some of the issues could have been avoided here, if they would not chase the PR and blog posts.

▲

tokioyoyo 4 hours ago | parent [-]

What's the "other way" that would be better in general?

	▲	Avamander 3 hours ago \| parent \| next [-]
		The release should've been done sooner once it was clear the embargo was broken and people figured out the vulnerability.
	▲	nicce 3 hours ago \| parent \| prev \| next [-]
		Some issues covered here: https://thephp.foundation/blog/2026/10/21/todays-php-securit...
	▲	pamcake 3 hours ago \| parent \| prev [-]
		More proactive outreach and better coordination with key downstreams.

▲

segmondy 3 hours ago | parent | prev [-]

Thanks to OpenAI, everything is a PR stunt.