It looks like the PHP Armageddon bug may have been a bit overstated in that exploits require severe-level pre-existing vulnerabilities
If I'm to be completely honest, though, "has pre-existing severe code-level vulnerability" describes a lot of the PHP sites I've seen in the wild.
But it really also does look like anybody describing waves of exploits targeting their site yesterday or heroic work by their "agents" to safeguard their servers may be operating on the reality-deficient side of the bullshit scale.
This would seem to be a good example of how software is full of trade-offs where every choice is bad (starting with "using PHP", he jokes)
The bug seems to be hard to exploit but not fixing would give well resourced actors an incentive to find ways to use it
But the fix is also huge and results in a patch that's impossible to review, and so might well introduce a bunch of exploitable bugs on its own.
Clearly patching is the lesser of two evils, but clearly neither option is outright "good"
But my observation was primarily that many of the claims I've seen surface over the past day or so seem quite dubious in hindsight and seems to have led to a herd effect of sorts.
Oct 22, 2026, 11:43 AMthis article does not do a very good job of explaining their position imho, which is fine - they are just venting
some of the POCs *do* include example PHP code, but it seems to be basically calling unserialize to make it happen faster
if you look at the "anime girl" video, you will note that the attack is against certain WP/Wiki/etc endpoints, not usually root, as these are the easier routes in
the short path to the use-after-free is via file uploads, but this is not the only path, just the easiest one
that said, i have not seen a lot of independent confirmation of the core exploit either, so the idea has some merit, so until i feel like opening a VM and testing it myself the mystery will remain
@baldur The worry about exploits available in minutes hasn’t worked out, it’s a risk balance. On the upside it’s produced great material for resilience chats with vendors...
@baldur That's just part of PHP's original DNA, no? (It may have evolved a great deal, but maybe not everyone followed suit.)
@drmabuese True.
Oct 22, 2026, 12:48 PM@baldur That's the thing - part of this being such a big event is that PHP itself is a cluster of a dev environment so the question of "does the site have another vulnerability?" is usually "probably" instead of "probably not"
And PHP is a cluster because back in the dotcom era software development decided that web development needed to prioritize being fast and cheap instead of engineered and decades later we're still constantly paying that price
@Jer Yeah, I don't think there's any version of looking at these events where you could conclude that PHP is overall a safe choice as it generally wasn't that safe a choice to begin with, as you point out.
Oct 22, 2026, 1:19 PM@baldur I can believe how we got here, but it still makes me mad that it's 2026 and we're still allowing non-memory safe languages to be used to write code open to the internet
Solutions to this particular problem have existed for decades but we're not going to do them for reasons that range from "too expensive" to "don't want to"