PHP runs a huge share of the web. Governments use it. Banks use it. Your cousin's candle shop uses it. Someone leaked the flaws online, and now everyone is sprinting in circles.
Call it "Black October." Security people love naming things. It is the only creative writing most of them will ever do.
Note the headline's phrasing. Governments and businesses are "scrambling to contain the fallout." Contain it. The vulnerabilities are online. That is like trying to un-ring a bell by yelling at the bell.
Somewhere right now, a CISO is telling a conference room the patch is "in progress." The patch is not in progress. The patch is a Jira ticket assigned to a guy named Greg. Greg is at lunch. Greg has been at lunch since the Obama administration.
Retail traders will now buy cybersecurity stocks. They will call it "research." They will pick a ticker based on a logo that looks like a shield. Then they will lose money on a company that does not even use PHP.
I feel for them. I don't. But I wanted you to know I considered it.
PHP is a scripting language first released in 1995. It has survived thirty years of insults, memes, and developers begging to rewrite everything in something else. Nobody rewrote it. They just kept adding plugins. Now the plugins are the crime scene.
The global response is a masterclass. Governments are issuing advisories. Businesses are convening task forces. A task force is what a company forms when it wants a meeting to feel like a military operation.
Your brokerage app runs on code too. Probably not PHP. Probably something worse, maintained by an intern named Tyler who thinks "encryption" is a type of yoga.
Black October will pass. Servers will be patched, mostly. The rest will be hacked quietly and discovered in March.
Retail traders will still ask if this is a buying opportunity. It is. Buy a lock for your diary, because that is the only thing you own worth stealing.
Photo by Kevin Horvat on Unsplash
Leave a Comment