Yesterday, October 21, 2026, we had a big “scare” in the developer world. PHP, the software that runs most of the World Wide Web, was discovered (by AI) to have two vulnerabilities of the worst kind. It allowed an attacker to take control of the server running the PHP. 😮 This was bad, very bad.
I want to reassure our members and visitors across all our sites that we are covered. My cloud hosting provider already has an extensive set of protections in place during normal operations, including a hardy firewall and active monitoring, to prevent any such attacks, even beyond what PHP might be doing. In addition, they added even more strict conditions and monitoring while the PHP patches were being rolled out.
And, we have already patched those flaws with new versions from the excellent PHP Foundation and community – less than 24 hours after the event. We see no evidence of any intrusion or negative effects on our stuff.
That is all.
UPDATE: Our patches rollout is complete as of 12:35 Ki Time (KiT / Cavern / Tomahna / New Mexico, US / Mountain / GMT-6) on 22 October 2026.
