いやマジで総理大臣がPHP脆弱性対応について発信してくれたおかげで社内への説明がクソ楽だった…「総理自ら発信するレベルですよ？？？ニュース見てないんですか？？？」で反論苦情殆ど封じることできた…

ちなみに、お若い方には信じられないかもしれませんが、 ホームページ制作会社でアルバイトとかすると Dreamweaver（ドリームウィーバー）などのサイト制作ツールを使わせてもらえず最初の半年は 「テキストエディタにHTMLタグを直打ち」 という修業期間があったりしました。だからインターネッツの老人たちの中には テキストテキストテキスト 👆これを、何も見ずに手で打てる人が結構いたりするんです。 インターネット老人たちよ、生きていて自分にイジワルしてくる人がいたら「display: none;」にしてやろうぜ。

Day 17/ Bet you thought we forgot, but no, it’s reset day today. Also good time to remind you to get Daybreak Blue access, it only takes 15 mins and you don’t want to have to do it in the middle of an incident.

phpに限らず、nodeもJavaも脆弱性の修正パッチが出てるので、どの言語やフレームワーク使ってても身構えておく必要がありそう とりあえずパッチが出たら早急に適用するか、あとはそもそも個人情報たくさん持たないようにするほうがいいのかも

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. openai.com/index/coordinated…

The Canada and Tokyo regions of Laravel Cloud are fully patched. Patching is in progress in Virginia, Ireland, Sydney, and France. Patched Laravel Vapor images are rolling out now.

PHPの重大な脆弱性に関し、本日午後11時に公開が予定されている修正パッチを可及的速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。

At 14:00 UTC two critical security vulnerabilities will be patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No manual action is required. Laravel Forge customers: you will need to manually update your server’s PHP version via the server’s Forge dashboard. If you are unable to update your server, it should be powered down. Laravel Vapor customers: we will begin automatically re-deploying applications running on PHP 8 as soon as the patch is released. No patch is being released for PHP 7 -- immediately update all applications to PHP 8.