Php is a programming language from the 90s that is still popular today but is kinda the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.
This has brought on a new round of bag punching.
There's a bug. Update it.
Pretty simple, but apparently people have decided to lose their minds over this one.
Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.
That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.
Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Don't worry. Everyone is just doing
sudo apt update
sudo apt upgrade
sudo shutdown -r now
Job done.
Oh and if you want to check your work.
r00ty@r00ted ~ $ php -v
PHP x.x.x (cli) (built: Oct 21 2026 xx:xx:xx)
Job definitely done.
In simple terms, PHP is a language telling servers on the internet what to do. There is a problem with it, one that's been known for a long time. But it wasn't considered a major one because using this problem for hacking purposes was thought to be so much work nobody would use it.
Enter LLM agents. They have all the computing power in the world and time isn't an issue. They used this vulnerability. And the internet panicked. Lots of smaller operations shut down as a precaution. I think there is a patch in the works. Edit: Patches are out already.
An embargo seems like a natural response to a threat like this. I'm not sure if it's a good idea because I don't know if you can just transition to using a different scripting language on any server. I understand it's a fairly old language in internet terms. So it might be time to move on, I don't know.
Edit: I think I misunderstood the question. The embargo people talk about is more like the iPhone review embargo. The new iPhone gets released to reviewers ahead of public release so they can test and produce their pieces. And the embargo end day is when they can release their findings. The PHP embargo is, I think, the movers and shakers behind the scenes agreeing to shut up about the details of a vulnerability until the patch is out. If they go public before the patch then more bad actors get the blueprint on how to exploit the vulnerability.
I will take no follow-up questions because I had it explained to me like I'm a 5yo.
top 50 comments