Something happened yesterday that I want to talk about: the PHP security release. Let me start by saying, if you haven't updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, go do that first. This post will still be here.
There were posts in relevant channels, at least they seemed relevant enough, about an upcoming PHP security release. This was an important one, so the PHP Foundation wanted people to be ready to upgrade, and I assume, not simply treat it as "we will do it when we do it". That part was fine. Several things that happened after it were worrisome, and I want to talk about them.
First, hackers proving the exploit over the internet. The CVE numbers leaked a day early, with a CVSS of 10.0 attached (the real score is 9.2), and a proof-of-concept video went up and came down, but not before it got copied around. This caused panic, and then social media, or bots, or both, started to share how to "fix" this.
Eventually there was the post from CERT-EU itself. Whether it was because of the social media momentum, or because they knew something we did not know, I don't know. But what they actually wrote was: patch immediately, and where that is not feasible, consider isolating internet-facing applications until the fix is in. Somehow that got distilled to "go offline". It was so bad that even governmental services here and there were not working. (Remember this, it is important for later.)
Then came the AI wave. I don't know how to name it exactly, so I am sticking with that. Panicked elephants, end-of-the-world style pictures, the works. And this while other critical security issues were also released yesterday, for example this one in GitLab. That one is an actual CVSS 10.0, unauthenticated, every self-managed version back to 2014, and no workaround. The AI wave propelled the panic and fear, because something really bad is happening in PHP so we all should panic EVEN MORE. How I experienced it: some RCEs are worse than others, so it is totally fine to accept some RCEs, or faulty signatures, as long as we panic over THIS one RCE!
To be fair, the PHP bugs were serious. Unauthenticated RCE is no joke, and patching fast was the right call. But the attention we gave each issue, before we even knew what the issues were, had nothing to do with the actual risk. It had to do with the noise.
Since 2020 or 2021, I have had the chance to do regular security trainings, and in 2023/2024 I also did more blue-team type training. After that, a refresher yearly. I don't want to bore you with the details of my career, but, like, the one thing they teach you all the time is: do not panic, and do not believe anyone that tries to instill a sense of urgency in you. So what did virtually 99% of anyone I know and "saw" online do? Panic.
I don't want to focus too much on the actual release process and how long it took for the patched version to propagate through all the different package registries, or containers, or the other ways of pulling this. I believe yesterday was a learning moment for everyone. What I found interesting were two posts about the "post mortem" of this release.
The first one is from the PHP Foundation. This entire post is excellent if you have not read it. It touches more topics than a simple "there's news". One thing that stood out to me: one of the providers that was part of the coordinated release broke the embargo more than 6 hours before the planned release. (Second thing that is important for later.)
The second post that I highly recommend is from Alexandre Dubois, who is in the security team. Alexandre saw firsthand how "internet points" can change an entire coordinated release schedule. He also showed us that the trending posts about changing our session ini settings were conflating bugs. The flag everyone was sharing belongs to the other CVE, and the stopgap the advisory actually puts first barely showed up anywhere. He mentions there was some good pre-release advice too, but at that point, we the people were just shooting darts in the dark. What we were effectively doing was opening up our deployments to manipulation from unverified sources. (Third important thing.)
Ok, now my main complaint-as-advice from what I experienced on the 21st of October 2026: just because someone on the internet said so, it does not mean it is true has never been more true.
What I learned if I were a malicious actor is that what I need is a good-enough bot farm, probably an insider at places that do not respect embargoes, and I can achieve a lot:
first, I can start a trend so everyone runs around ignoring some other CVE that I have a better grip on exploiting.
second, I can try to get embargoes broken. This gives me access to a LOT of services that simply cannot get a patched version, because they are not in the provider's (offender's) chain.
third, I can even engage in proxy wars by limiting governmental functions, or annoy some population elsewhere and blame it on the followers of the party I do not support.
fourth: probably more, but I don't really like being a red-team player.
So next time: patch, yes. Fast, yes. But read the actual advisory, ask which bug a "fix" is fixing, and when someone tries really hard to make you hurry, that is exactly the moment to slow down.
