I’ve supported and administered PHP applications since at least 1998, when I started working for Net Communications Ltd. in Norwich. Back then, it was a blossoming web language.
It competed with CGI (Common Gateway Interface) systems, where Perl or Python applications were far more common (and often much slower). Over the years, the way you called PHP has varied, but it’s certainly much easier now than ever to set up a web server running PHP and deploy any number of applications written for it.
Since I started my current job, I’ve learned to (re-)appreciate how good Apache is compared with nginx, which I’d used exclusively for at least 7-8 years. Configuring a LAMP stack now is crazy easy.
But alas, as with everything, it is a never-ending cycle of patching and updating, especially when a critical vulnerability is discovered. Ordinarily, you’d set aside time each week to patch servers and keep them up to date. Except this week, someone discovered (through the magic of AI) a massive critical vulnerability in PHP that absolutely required a patch/update, since no configuration fully protected PHP from exploitation.
Even if you were behind a WAF like Cloudflare with a mitigation in place for php2shell, it’s not unthinkable that attackers (who could also be using AI) could find new ways around it. But it is better than nothing. In most cases, pretty much everybody took their websites down until PHP could be patched, which was a more sensible form of protection until vendors rolled out patches. I haven’t encountered too many situations like this in my almost 30-year career. It’s certainly not the first, but when it happens, it’s still a bit of a shock.
What is interesting about Cloudflare, though, is that they had effectively made their mitigation rules available before the official announcements and vendors’ patches. But WAFs, even very proactive ones, are never intended to replace a fully patched service. For example, Red Hat didn’t start rolling out fixes until late that evening. These fixes cover multiple PHP versions, depending on your distribution.
As cybersecurity and criminals increasingly use AI, the race to detect and patch vulnerabilities like this intensifies. It’s a cat-and-tweety-bird game. And as a sysadmin, we’re going to have to get used to saying, “I tawt I taw a puddy tat!” “I did! I did tawa puddy tat!”.