National Security Agency decides to wreck havoc on PHP developers

https://x.com/NSACyber/status/2112903220209098897

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server’s file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

I’ve already heard of this news earlier (yesterday or 10/21/22), but didn’t take the time to see what it was actually about, so I didn’t care nor did I know why people were freaking out about it. But I do remember hearing about the catastrophes and websites going down when this news initally came out, although I was suspicious of the news in question. So it’s nice to see at the last minute what this whole fiasco was about.

https://x.com/VicVijayakumar/status/2113085217099460955

1995: PHP is dead, learn ColdFusion

2002: PHP is dead, learn ASP.net

2003: PHP is dead, learn Django

2004: PHP is dead, learn Ruby on Rails

2010: PHP is dead, learn Flask

2011: PHP is dead, learn AngularJS

2016: PHP is dead, learn Next.js

2022: PHP is dead, learn Solidity

2026: The NSA is advising that you turn off PHP

I guess that’s one way to stick it to the anti-PHP charlatans. PHP is absolutely not dead!

(P.S. if you’re curious, obv I just updated to PHP 8.3.36 and I did that for another server I have as well, no use commenting on a vulnerability if it’s just a way to admit open season on your website.)