There was that PHP thing, as well as *sshole, and how do we know the supermarket attackers didn't use AI?
While I'm not going to claim the PHP thing wasn't a real vulnerability, it... doesn't seem to have actually been catastrophically exploited? Maybe it's just too soon and over the next year we'll see a steady stream of people announcing leaks caused by failing to update php in time? Maybe there's a bunch of servers out there running old version of wordpress and quietly mining bitcoin because of it?
loading story #50450275
But PHP thing was a lot of drama over something that was not super large easy to exploit hole. Just a normal "have to patch it and bye" medium kind issue.
> Just a normal "have to patch it and bye" medium kind issue.
Patching it was the issue, not the hole.
1. The patches had to be unofficially backported to the versions of php that most people were using.
2. Devs had to figure out if the unofficial backports were safe and they weren't just falling into trapped versions
3. Devs had to migrate all of their projects to unofficial versions
4. No one was ready for it to happen because there was no advance notice (someone broke the embargo) for everyone to plan maintenance windows and upgrade at the same time.
loading story #50448029
loading story #50447862