PHP-ocalypse: How two critical web bugs almost broke the internet
The part that sticks with me is how quietly close we came to chaos. PHP sits underneath so much of the web that two bugs turning into full exploits could have taken down shopping carts, login systems, and entire content platforms all at once. The fact that the fixes went out before attackers weaponized them is more luck than strategy.
What I keep circling back to is the maintenance problem. PHP has been around for decades, and a language that powers the majority of the internet shouldn't be surviving on volunteers and last-minute patch scrambles. We treat these ecosystems as free infrastructure, but free doesn't mean zero responsibility. Someone has to keep the lights on.
I'd want to know how many sites actually applied the patch in time, and whether the delay between disclosure and exploitation was measured in hours or days. Because the next time, the window might be shorter. We got lucky here. I'd rather see the industry treat that as a warning than as proof the system works.