Something happened yesterday that I want to talk about: the PHP security release. Let me start by saying, if you haven't updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, go do that first. This post will still be here.

There were posts in relevant channels, at least they seemed relevant enough, about an upcoming PHP security release. This was an important one, so the PHP Foundation wanted people to be ready to upgrade, and I assume, not simply treat it as " we will do it when we do it ". That part was fine. Several things that happened after it were worrisome, and I want to talk about them.

First, hackers proving the exploit over the internet . The CVE numbers leaked a day early, with a CVSS of 10.0 attached (the real score is 9.2), and a proof-of-concept video went up and came down, but not before it got copied around. This caused panic, and then social media, or bots, or both, started to share how to "fix" this.

Eventually there was the post from CERT-EU itself .…