Not all hacks are used to steal data. It's an authoritative website. If this hack is used to host a fake PHP fix stuffed with credential stealers then you have a problem.
Oh I absolutely agree they should take it offline until the fix is ready, I just mean that the NCSC itself is very much still operational even if their public website is temporarily offline. Like a computer with the monitor switched off.
Sometimes, they just want to send spam. Ages ago, someone got a hold of our company's webserver and all they used it for was sending a ridiculous volume of emails. Our ISP spotted the traffic spike and pulled our server off the network.
I don't know. Still, at a time like this I would expect a 99% static public website to be up, running and serving all comers. This is a complete mission fail, both in terms of using PHP and in terms of not having a fall-back plan in place.
Due respect, neither of those make sense. PHP is boring software, and this website routinely suggests (1) use it if it is fit for purpose and (2) don't rewrite for the sake of it. For most sites, the engineering effort to have a static backup of their dynamic website (say, generated by Wordpress or Drupal) just isn't possible. They just need to power down and patch.
[EDIT: I see I may have erroneously extended your criticism to sites other than NCSC, for which it does make sense. I would still defend using PHP.]
Because websites with news, continuously updated advice, job openings, etc aren't all that static? This type of site hugely benefits from having a easily understandable CMS that you can teach to more or less everyone in 2 days or less. I suffered through a few of those back in my time in the military, where an instructor would teach a class of 20-30 how to build new pages in the CMS
Now are there more powerful tools out there that result in more scalable websites? Sure. My personal sites are built around static site generators for that exact reason. But none of better tools are as easy to understand for non-programmers as wordpress or one of the other click-and-drag CMS tools.
PHP is going to publish the patch in 5 minutes, right? On their website which runs on... Perl Catalyst? Ruby on Rails? Django? What could possibly go wrong?
Because you need a certain amount of notice and in this case drama to be created so people know to update ASAP, before the exploit is out in the wild. As soon as these patches are out it becomes a lot easier for any actors to figure out exactly what they are patching, and how to exploit it.
Announcing when this patch is going to be released should leave a much shorter vulnerable window with the exploit out in the wild than releasing it immediately and hoping people update before they're a target.
Once the fix is released, people will reverse-engineer it and use the exploit on pages that haven't updated yet.
So they need to give time for infra people in all different time zones to wake up, learn about the announcement, and plan how to patch it.
The intended course of action is 1. take down website a few hours before the fix drops 2. apply the fix 3. only make website public again after it has been fixed
Tons of sites are currently offline to hopefully prevent an attack until they can update PHP; just the things I've run into this morning: OBS, TicketTailor, tons of wikis...
I thought they were down earlier, but apparently they were just pre-announcing being down in about 30 minutes, until they finish patching their servers.
I've seen a number of notifications on X and Bluesky of people taking their sites offline, though. Supposedly Cloudflare is providing all customers a WAF rule that will mitigate the exploits they've been able to see so far (though they mention, this is not full protection—patching is still required).
Which kind of makes sense, I think a lot of Dutch websites have been taken offline. I think it’s due to recent regulations that have been introduced.
I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.
That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?
But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.
Yes our university is doing the same right now! They where thinking of putting the whole network behind VPN access to protect the poor sysadmins in the Institutes that have not updated their website in years…
It creates an absolutely enormous political snarl to decide who is "worthy" of getting advance notice on something like this, and to correctly determine who is capable of keeping the secret in the presence of highly motivated active attackers who may have capabilities all the way up to and including "state level actors".
Basically, it's only possible in our imaginations where we don't have to get into the nitty-gritty of exactly who gets what notifications. It isn't possible in reality for something this large and consequential.
I just moved my last PHP site, my personal blog, to a static site generator. It looks like my timing was lucky!
The only significant thing lost of comments, but they have been getting more spammy over the years. Its actually better now too in many ways and I fixed various issues during the move.
Which is why suggestions like OP’s are never useful or actually serious. I honestly consider them snobby. Like the person who tells you you really ought to check your engine oil, radiator fluid, and brakes everytime you get in a car. It would prevent some awful issues sure, but it’s not gonna happen for 99% of people.
Having static site generator still require an admin endpoint that end users can use to author, publish or otherwise manage the content. Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git. Not to mention if there is no server side component that means the client needs to have full permission to publish content on the server. Until recently ssh was the only option. Maybe someone could vibe an iroh app that gives you a vpn'd server side app without that now.
Did you try to implement it seriously? Naturally you need an admin endpoint, it just does not have to be reachable for everybody from the internet, just via your VPN. Big difference.
The person you're replying to didn't mention a static site generator. You could simply use Vinyl(fka Varnish), and after you pulled your PHP down, your boring brochure site would still be up.
The first site I put up professionally was a handrolled static generator written in PHP for a state website. Users just edited text files, triggered a rebuild, and then there was a sync to prod if staging looked fine. They could even add new sections by creating new subdirectories, and Imagemagick would automatically conjure new menu buttons and the code would put them in the right place.
> Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git.
This is not hard. Rsync? Rsyncd?
> Not to mention if there is no server side component
Why would there be no server-side component? What does that even mean? Just give them a script to trigger if you don't want them to have permission to do anything. Give them another script to revert if you don't want to get any emergency calls.
This is not advanced technology. Weird to talk about it like it's impossible.
> never useful or actually serious
So strange. That site was so simple to deal with that it stayed up for a decade after I left. Ancient technology.
Generate static pages from your content system. Even for wordpress there's some projects.
If you need adaptations, AI should be helpful.
You can sell this also to bosses: Delivery of static sites consumes drastically less resources.
Because every once-in-a-lifetime AI is invented and finds security flaws in PHP? Seems like you are coming to an overly broad conclusion here. Besides, you have to serve the static HTML somehow, and Apache and Nginx have had plenty of security vulnerabilities.
PHP is worse in this aspect with its long tail of legacy and staying close to C. It's absolutely possible that memory-unsafe Python interpreters could have something vaguely similar, but it's much less likely. Plus there are Python interpreters in memory-safe languages.
In any case, memory-unsafe codebases will continue to be a significant danger. Be it in interpreters or anywhere else. Just like they have been for the past 20+ years.
I know nothing about the Belgian Center for Cybersecurity, but the fact that they are running a platform that has been infamous for its security issues for 25 years, and been considered essentially obsolete for 15 years, immediately makes me not take them seriously.
This is like a Health Ministry recommending leech therapy to its employees.
That's reducing things too far. "What car manufacturer hasn't had car crashes?" All cars are equally safe?
There's a vast difference between different languages and CMSs and how likely it is for critical flaws to occur. PHP has a horrible track record and continues to surprise us negatively.
Given the % of traffic of the web it serves and over how long, I actually wonder if you have any proof that PHP actual track record in on the bad side because I think it will probably be on the better side actually, same for Wordpress specifically.
I fought hard about four years ago at a previous company to upgrade us from PHP 5 to 8 because I think 5 was going EOL or something like that (could be wrong about that now). Based on my experience in software, I have to imagine the vast majority of normal developers do not give a damn about security in being in security patch lifecycles on software.
> I have to imagine the vast majority of normal developers do not give a damn about security in being in security patch lifecycles on software.
I just don't think it's the developer's responsibility.
Depending on the size of the team of course, but the work that developer's do comes from someone else. Empower me to make decisions and I'll make them, but don't blame me for the choices other people make if you won't empower me.
I think I get where you're coming from. I've worked mostly on small teams (sub 30) so it's always been on us. The engineering leadership never prioritizes security unless it's something as big as the log4J stuff because it was on customers' minds.
That said, if they're software packages from something like Node or PyPI, I do think that it falls on the developer. If the point is that leadership needs to give devs the ability to act on that, that's very fair.
Exactly. It's not the bricklayer's responsibility when mortar fails. It's the person who specified that mortar.
So I'd agree it isn't not a coder or developer's responsibility when they're given a bill of materials and told how to build, but it is an engineer's responsibility. Comp should recognize that as well.
I've worked at a company that delivered on-premise software, and the runners of said software were... risk-averse, but in a strange way in that they didn't really want to upgrade software if it didn't need to. So the software was stuck on PHP 5.something, also because newer versions required a RHEL update which they also didn't like to do.
>Safely ahead in a digitally resilient Netherlands.
Things being offline seems like a daily occurrence recently. Is it a co-incidence? Is it AI? Are Russia/Iran doing an e-blitzkrieg?
If it's a combination of all three, surely nation states are going to unleash everything possible right now and do as much damage before the world adapts and becomes resilient?
If the latter, would be interesting to put an actual cost on all this downtime and whether it's actually making any impact, or is just noise/free training.
> Today, a remote code execution vulnerability was found in PHP, called php2shell.
[...] Since explain xkcd is affected by this exploit, I have decided to take the wiki down until tomorrow.
WJW | 9 hours ago
BlackRabbit1 | 9 hours ago
baaym | 9 hours ago
WJW | 8 hours ago
fhdkweig | 6 hours ago
Sometimes, they just want to send spam. Ages ago, someone got a hold of our company's webserver and all they used it for was sending a ridiculous volume of emails. Our ISP spotted the traffic spike and pulled our server off the network.
[OP] jacquesm | 8 hours ago
piker | 8 hours ago
[EDIT: I see I may have erroneously extended your criticism to sites other than NCSC, for which it does make sense. I would still defend using PHP.]
spockz | 7 hours ago
WJW | 7 hours ago
Now are there more powerful tools out there that result in more scalable websites? Sure. My personal sites are built around static site generators for that exact reason. But none of better tools are as easy to understand for non-programmers as wordpress or one of the other click-and-drag CMS tools.
Hamuko | 9 hours ago
https://yle.fi/a/74-20252600
tosti | 9 hours ago
freshpaint | 9 hours ago
tosti | 8 hours ago
p-e-w | 8 hours ago
worldsavior | 8 hours ago
Ambroos | 8 hours ago
Announcing when this patch is going to be released should leave a much shorter vulnerable window with the exploit out in the wild than releasing it immediately and hoping people update before they're a target.
hmry | 8 hours ago
So they need to give time for infra people in all different time zones to wake up, learn about the announcement, and plan how to patch it.
The intended course of action is 1. take down website a few hours before the fix drops 2. apply the fix 3. only make website public again after it has been fixed
NiloCK | 8 hours ago
Scheduled release gives the option to turn things off on a set schedule while applying patches.
e: turns out several people answered this. Whoops.
jayknight | 8 hours ago
https://github.com/php/web-php
Cthulhu_ | 8 hours ago
kyriakos | 5 hours ago
geerlingguy | 9 hours ago
reddalo | 8 hours ago
geerlingguy | 8 hours ago
I've seen a number of notifications on X and Bluesky of people taking their sites offline, though. Supposedly Cloudflare is providing all customers a WAF rule that will mitigate the exploits they've been able to see so far (though they mention, this is not full protection—patching is still required).
vanderZwan | 7 hours ago
Parae | 8 hours ago
geerlingguy | 8 hours ago
stingraycharles | 9 hours ago
I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.
That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?
martijnvds | 9 hours ago
stingraycharles | 8 hours ago
trollbridge | 8 hours ago
jaydenkieran | 8 hours ago
But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.
apexalpha | 8 hours ago
esseph | 8 hours ago
bcvvvy | 5 hours ago
rapnie | 8 hours ago
Europa.eu and all related subdomains were down very early CEST morning. They run Drupal.
meffmadd | 8 hours ago
jerf | 6 hours ago
Basically, it's only possible in our imaginations where we don't have to get into the nitty-gritty of exactly who gets what notifications. It isn't possible in reality for something this large and consequential.
mkesper | 9 hours ago
graemep | 8 hours ago
The only significant thing lost of comments, but they have been getting more spammy over the years. Its actually better now too in many ways and I fixed various issues during the move.
woile | 8 hours ago
https://sequoia.pub/comments
geerlingguy | 8 hours ago
apexalpha | 8 hours ago
Unfortunately my static HTML is pre-rendered by a PHP engine before being served.
cm-t | 8 hours ago
It's a static web site generator, powered by php :)
Cthulhu_ | 8 hours ago
These particular vulnerabilities affect PHP scripts accepting POST requests as far as I've been able to gather so far.
CodeCompost | 8 hours ago
eddythompson80 | 8 hours ago
Having static site generator still require an admin endpoint that end users can use to author, publish or otherwise manage the content. Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git. Not to mention if there is no server side component that means the client needs to have full permission to publish content on the server. Until recently ssh was the only option. Maybe someone could vibe an iroh app that gives you a vpn'd server side app without that now.
mkesper | 7 hours ago
pessimizer | 6 hours ago
The first site I put up professionally was a handrolled static generator written in PHP for a state website. Users just edited text files, triggered a rebuild, and then there was a sync to prod if staging looked fine. They could even add new sections by creating new subdirectories, and Imagemagick would automatically conjure new menu buttons and the code would put them in the right place.
> Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git.
This is not hard. Rsync? Rsyncd?
> Not to mention if there is no server side component
Why would there be no server-side component? What does that even mean? Just give them a script to trigger if you don't want them to have permission to do anything. Give them another script to revert if you don't want to get any emergency calls.
This is not advanced technology. Weird to talk about it like it's impossible.
> never useful or actually serious
So strange. That site was so simple to deal with that it stayed up for a decade after I left. Ancient technology.
eddythompson80 | 6 hours ago
Thanks for proving my point.
> This is not hard. Rsync? Rsyncd?
How do I do that on an iPad or an Android?
> Just give them a script to trigger if you don't want them to have permission to do anything.
uhhh, what permissions does that "script" have? or is that your /wp-admin equivilent?
> So strange.
Indeed.
lp92 | an hour ago
eddythompson80 | an hour ago
gadders | 6 hours ago
(So old.....)
mkesper | 7 hours ago
SAI_Peregrinus | 2 hours ago
ltbarcly3 | 5 hours ago
moi2388 | an hour ago
ltbarcly3 | 5 hours ago
louwrentius | 8 hours ago
phplovesong | 8 hours ago
Avamander | 8 hours ago
In any case, memory-unsafe codebases will continue to be a significant danger. Be it in interpreters or anywhere else. Just like they have been for the past 20+ years.
jonwinstanley | 8 hours ago
lp92 | an hour ago
sam_lowry_ | 8 hours ago
Dark day for Drupal and Wordpress, heh
p-e-w | 8 hours ago
This is like a Health Ministry recommending leech therapy to its employees.
sam_lowry_ | 8 hours ago
Anyway.
CCB is overtly a marketing organization, not an IT security one.
IIRC they don't even host their own website, The Chancellery of the Prime Minister does it for them.
Avamander | 8 hours ago
That's reducing things too far. "What car manufacturer hasn't had car crashes?" All cars are equally safe?
There's a vast difference between different languages and CMSs and how likely it is for critical flaws to occur. PHP has a horrible track record and continues to surprise us negatively.
nolok | 5 hours ago
Avamander | an hour ago
brazukadev | 7 hours ago
freecodeio | 8 hours ago
jjice | 8 hours ago
forgotaccount3 | 8 hours ago
I just don't think it's the developer's responsibility.
Depending on the size of the team of course, but the work that developer's do comes from someone else. Empower me to make decisions and I'll make them, but don't blame me for the choices other people make if you won't empower me.
jjice | 8 hours ago
That said, if they're software packages from something like Node or PyPI, I do think that it falls on the developer. If the point is that leadership needs to give devs the ability to act on that, that's very fair.
expedition32 | 7 hours ago
When a doctor makes a mistake they get to practice medicine in Peru for the rest of their life.
Terretta | 6 hours ago
So I'd agree it isn't not a coder or developer's responsibility when they're given a bill of materials and told how to build, but it is an engineer's responsibility. Comp should recognize that as well.
Cthulhu_ | 8 hours ago
bombcar | 8 hours ago
Once it's out it's likely to be an easy "disable this damnable feature nobody needs" as usual.
rocky_raccoon | 8 hours ago
There's no such thing as PHP 6. There's no such thing as PHP 9.2.
esseph | 6 hours ago
rocky_raccoon | 5 hours ago
2OEH8eoCRo0 | 8 hours ago
panstromek | 8 hours ago
4ggr0 | 7 hours ago
dmitrijbelikov | 8 hours ago
phplovesong | 8 hours ago
rasz | 8 hours ago
gaiagraphia | 8 hours ago
>Safely ahead in a digitally resilient Netherlands.
Things being offline seems like a daily occurrence recently. Is it a co-incidence? Is it AI? Are Russia/Iran doing an e-blitzkrieg?
If it's a combination of all three, surely nation states are going to unleash everything possible right now and do as much damage before the world adapts and becomes resilient?
If the latter, would be interesting to put an actual cost on all this downtime and whether it's actually making any impact, or is just noise/free training.
amosj | 8 hours ago
> Today, a remote code execution vulnerability was found in PHP, called php2shell. [...] Since explain xkcd is affected by this exploit, I have decided to take the wiki down until tomorrow.
HelloUsername | 8 hours ago
aequitas | 7 hours ago
ltbarcly3 | 5 hours ago
[OP] jacquesm | an hour ago
genxy | 2 hours ago