Commit

Old code can hide serious bugs for more than a decade. This week we saw it up close. A critical flaw in PHP, nicknamed "php2shell", was disclosed and fixed upstream. It let an attacker run code on a server without logging in. The bug had sat in PHP since 2012. Stronger AI models now find old bugs like this faster. We started with an inventory: every system running PHP, with its version, ordered by how exposed it was. As a stopgap, we switched off a risky upload feature while patches rolled out. Then we installed the fixed versions across our websites, a client-facing platform and internal tools in about two days. We also added an alarm for unexpected processes and reviewed our logs. We found no sign of any attack. Finally, we retired an old server that could never be patched. One honest gap: only one of our servers patches PHP on its own. Our container-based apps are still patched by hand, so automating that is on our list. Node.js and Java also shipped urgent security fixes the same week. Our takeaway: know what you run, patch quickly, and explain the risk in plain words. Could you check your PHP, Node.js and Java versions today? You may be surprised.