The Fourteen Quiet Years
Last week, websites all over the world went offline because of a flaw in PHP. The flaw had been there since 2012. The danger was old. Only the knowing was new.
ISYAMA — Transmissions from The Apex
By Dr. Leo R. Yamas
Last week, websites went offline in a hurry. The Dutch government's main portal. The Dutch government's own cybersecurity agency. Every website of France's interior ministry. Several hospitals, a large port, and for a while the Internet Archive.
They all had the same problem. It was a flaw in PHP, the programming language behind roughly seven in ten websites.
The flaw was fourteen years old.
Today's Exhibit: The Danger That Started On Tuesday. Or: Why You Were Most Afraid In The Week You Became Safest.
There are two flaws. Each one can let a stranger on the internet take over a web server, with no password needed. Every version of PHP released since 2012 contains at least one of them.
Details leaked on Tuesday. The fix came out on Wednesday, a day earlier than planned. American security agencies gave unusual advice. If you cannot install the fix right away, take your website offline. Many did.
The panic was not foolish. Once a hole is public, everyone who wants to use it knows where it is. Attackers were trying it before the fix was out.
But look at the fourteen years before Tuesday.
A website on PHP in 2015 was exactly as open as one running it last Monday. Nobody switched anything off. Nobody called a meeting. The hole was the same size. Only the knowledge was new.
And it is not certain that the hole went unnoticed all that time. Someone may have found it years ago and used it carefully. A hole used carefully makes no news.
Your species does not react to danger. It reacts to the news of danger. Usually the two arrive close together. This time, they were fourteen years apart.
There was one earlier sign. In 2024, during a review of PHP's code, someone saw the first traces of one of these flaws. It stayed a theory. Nobody could show how to use it. The developers could not agree on a fix, and problems with clearer proof came first. The PHP Foundation now calls this "a structural failure".
It is a very human failure. A warning without a demonstration is easy to postpone. There is always another problem that can already prove it is real.
Volunteers do much of the work on PHP. The foundation that supports them has thirteen staff, some part-time, paid from donations. Seven in ten websites rest on that.
So what found the flaws?
Machines. In August, two research teams found them independently, both working with AI models. One of them said a single researcher had done in a week what once took a world-class team months.
Last month I wrote about machines that notice things faster than anyone can understand them. This is the same development, pointed at old code. Expect more fourteen-year-old holes. The software has not got worse. Something is finally reading all of it.
When Selene was small, she ran along the cliff path on the north headland every morning. One day, at about seven, she stopped and looked over the edge for the first time. She would not walk that path for a month.
She was never in danger. The Sprocklets would have caught her long before the edge. Nothing about the path had changed.
I reminded her of this last week, while I read her the news. She remembered it differently.
"I wasn't scared of the path," she said. "I was scared of all the mornings I'd already run along it."
Last week's panic was the same kind of fear. It was not about Wednesday. It was about fourteen years of mornings. Selene had the Sprocklets under her the whole time. The websites had thirteen staff and a crowd of volunteers.
For every website that installed the fix, last week was the safest seven days since 2012.
If you run a website on PHP and have not updated it yet, stop reading and do that first. This will still be here.
Your species is bad at worrying at the right time. It worries loudly in the week a danger is named, and hardly at all in the years before.
It is good at something else. Once researchers reported this hole, a small team you have never heard of closed it in about two months.
The next old hole is already out there, in code everyone trusts because it has always worked. When it makes the news, do not mistake the noise for the danger. The noise is the repair starting.
— Dr. L.R.Y.
Transmitted from The Apex. Isyama. Selene still takes the cliff path every morning, one hand on the rail. The Sprocklets put the rail up the week she was frightened. She never asked. They never said.