PHP2Shell: two critical PHP vulnerabilities take half the Internet offline

By Javi and Pablo · Rafa takes a break and follows the café from the chat

PHP has two critical security bugs. They let anyone run code on your server without a login. They affect WordPress, MediaWiki, Magento, Joomla, Laravel and everything that runs PHP. At first, a score of 10 out of 10 goes around. The real score is 9.2, and Javi sums it up: «an outrage».

On October 20, PHP announces a security release on its blog for October 21 at 14 UTC. But the details of the bugs leak before the patch. The vulnerabilities were reported in 2024, but nobody knew how to exploit them then. Now several companies can, and Amazon detects exploit attempts on October 18. One company patches its own servers, and that helps the details leak.

The NSA, the FBI, CISA, the UK government and the European CERT give the same advice: take your website offline, update it and put it back online. According to Censys, 1.5 million servers run a version without the fix. Even the Prime Minister of Japan posts a warning. Government websites, Wikipedia, archive.org and the Port of Rotterdam go offline.

Officially, PHP gives security support only from 8.2 onward. Even so, PHP also publishes the patch for 7.4, 8.0 and 8.1. For older versions, you have the repositories of Ondřej Surý and Remi Collet. Javi's lesson: if your cooldown policy waits 7 days to update dependencies, make an exception for critical patches. Watch in the video.

Addy Osmani: the bottleneck is not writing code anymore, it is verifying it

Addy Osmani publishes «Agentic Verification». His thesis: to get quality output from your agent, give it a way to verify its work. Tests are part of that way. The post separates example tests, which say what must happen, from property based testing, which says what must not happen. It compares two loops: in the human dominated loop, you review and report each bug. In the self-verifying agent, the agent writes, runs the check, reads the output and tries again.

For Javi, tests and good architecture were never an aesthetic whim. They are software economics. Now they also let you give agents more autonomy and gain speed. If your company does not let you write tests, you have a new argument. Pablo adds Martin Fowler's design payoff curve: if you invest in design early, you evolve the product faster later. Watch in the video.

Farewell to Arc: The Browser Company shuts it down on December 22

The Browser Company says goodbye to Arc with a post and an animated signature. For months, Arc only gets the Chromium updates. For Pablo, Arc changed the browser ecosystem with side tabs. The same day, Pablo recalls another goodbye: the Deno team joins Cloudflare, and the Deno runtime can lose its maintenance.

Javi suggests alternatives. The first one is Zen, based on Firefox: it is fast, it takes inspiration from Arc and it supports engine diversity. The second one is Firefox itself, which already has vertical tabs and pinned favorites in the Arc style. If you want to stay on Chromium, you also have Helium. In the chat, people share their picks: Zen, Brave and Vivaldi. Watch in the video.

The utility of the week

RFirma

An alternative to AutoFirma, by Sergio Gómez, to sign documents with your Spanish digital certificate. Its claim: it does not use Java. It is made in Rust with Tauri, it is open source and it works on Linux, Mac and Windows. It is still in alpha, but Pablo tries it and it works the first time.

https://rfirma.sgomez.me

The chat weighs in

uvedevendetta: In the end, other maintainers also backported the fix to old versions

biko8: You can use REA to see what is behind Keepa

Otroidentificador: Maybe they just change the user-agent of the bots, and robots.txt decides if you give access or not?

Agenda

NetCoreConf Madrid 2026 · 2026-10-23
Valencia Testing 2026, the software testing festival · 2026-10-27
Mozilla Festival 2026, in Barcelona · 2026-10-28
WordCamp Valencia 2026 · 2026-10-31

The song of the week

Javi: «El abuelo Frederick» — Los Delinqüentes (A classic that takes you back to glorious moments.) Watch in the video.

The café's music playlist: cdly.to/playlist

The saying of the week

«El que poco coco compra, poco coco come (who buys few coconuts, eats few coconuts)»

If you do nothing, nothing happens to you. If you set up servers, things will happen to you. They are welcome: that is why we are here. Watch in the video.

More Codely

Jev y modelos System One: Usos prácticos

The new course in the artificial intelligence track, exclusive to the Premium plan. The first three videos are free and you do not need to give your email.

The joke of the week: Controversy at the Planeta Prize: an AI wrote the winning novel. In Spanish, AI is «IA»: Isabel Allende.

All the news we covered

#CaféConCodely · @CodelyTV · Previous cafés: cdly.to/cafe

Share on Twitter Share on LinkedIn