Dutch National Cyber Security Center is Offline because it uses PHP
ncsc.nl
ncsc.nl
I've seen a number of notifications on X and Bluesky of people taking their sites offline, though. Supposedly Cloudflare is providing all customers a WAF rule that will mitigate the exploits they've been able to see so far (though they mention, this is not full protection—patching is still required).
The only significant thing lost of comments, but they have been getting more spammy over the years. Its actually better now too in many ways and I fixed various issues during the move.
Unfortunately my static HTML is pre-rendered by a PHP engine before being served.
It's a static web site generator, powered by php :)
These particular vulnerabilities affect PHP scripts accepting POST requests as far as I've been able to gather so far.
Having static site generator still require an admin endpoint that end users can use to author, publish or otherwise manage the content. Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git. Not to mention if there is no server side component that means the client needs to have full permission to publish content on the server. Until recently ssh was the only option. Maybe someone could vibe an iroh app that gives you a vpn'd server side app without that now.
The first site I put up professionally was a handrolled static generator written in PHP for a state website. Users just edited text files, triggered a rebuild, and then there was a sync to prod if staging looked fine. They could even add new sections by creating new subdirectories, and Imagemagick would automatically conjure new menu buttons and the code would put them in the right place.
> Pushing that to a local tool means now you need to somehow synchronize that content across all of the end users devices without git.
This is not hard. Rsync? Rsyncd?
> Not to mention if there is no server side component
Why would there be no server-side component? What does that even mean? Just give them a script to trigger if you don't want them to have permission to do anything. Give them another script to revert if you don't want to get any emergency calls.
This is not advanced technology. Weird to talk about it like it's impossible.
> never useful or actually serious
So strange. That site was so simple to deal with that it stayed up for a decade after I left. Ancient technology.
Thanks for proving my point.
> This is not hard. Rsync? Rsyncd?
How do I do that on an iPad or an Android?
> Just give them a script to trigger if you don't want them to have permission to do anything.
uhhh, what permissions does that "script" have? or is that your /wp-admin equivilent?
> So strange.
Indeed.
(So old.....)
I think, given the (supposed) seriousness of this issue, it’s an adequate response. I suspect Cloudflare et al will have rules added to their managed WAFs within a few hours after release as well.
That said: it seems like the core issue is that they can’t release PHP publicly without revealing the exploit, wouldn’t it have made more sense to coordinate in the background with these organizations, and important distros, so that this could have been patched without revealing the exploit?
But they say it's a stopgap and still advise patching. It makes sense, since their tweet also says "are updating mitigations as new vectors show up" so it seems like there are many ways to exploit this, whatever it is.
Europa.eu and all related subdomains were down very early CEST morning. They run Drupal.
Basically, it's only possible in our imaginations where we don't have to get into the nitty-gritty of exactly who gets what notifications. It isn't possible in reality for something this large and consequential.
Dark day for Drupal and Wordpress, heh
This is like a Health Ministry recommending leech therapy to its employees.
Anyway.
CCB is overtly a marketing organization, not an IT security one.
IIRC they don't even host their own website, The Chancellery of the Prime Minister does it for them.
That's reducing things too far. "What car manufacturer hasn't had car crashes?" All cars are equally safe?
There's a vast difference between different languages and CMSs and how likely it is for critical flaws to occur. PHP has a horrible track record and continues to surprise us negatively.
I just don't think it's the developer's responsibility.
Depending on the size of the team of course, but the work that developer's do comes from someone else. Empower me to make decisions and I'll make them, but don't blame me for the choices other people make if you won't empower me.
That said, if they're software packages from something like Node or PyPI, I do think that it falls on the developer. If the point is that leadership needs to give devs the ability to act on that, that's very fair.
When a doctor makes a mistake they get to practice medicine in Peru for the rest of their life.
So I'd agree it isn't not a coder or developer's responsibility when they're given a bill of materials and told how to build, but it is an engineer's responsibility. Comp should recognize that as well.
Once it's out it's likely to be an easy "disable this damnable feature nobody needs" as usual.
There's no such thing as PHP 6. There's no such thing as PHP 9.2.
Sometimes, they just want to send spam. Ages ago, someone got a hold of our company's webserver and all they used it for was sending a ridiculous volume of emails. Our ISP spotted the traffic spike and pulled our server off the network.
[EDIT: I see I may have erroneously extended your criticism to sites other than NCSC, for which it does make sense. I would still defend using PHP.]
Now are there more powerful tools out there that result in more scalable websites? Sure. My personal sites are built around static site generators for that exact reason. But none of better tools are as easy to understand for non-programmers as wordpress or one of the other click-and-drag CMS tools.
That you want your content to be readable from everyone doesn’t mean you want the admin interface to be available globally.
Announcing when this patch is going to be released should leave a much shorter vulnerable window with the exploit out in the wild than releasing it immediately and hoping people update before they're a target.
So they need to give time for infra people in all different time zones to wake up, learn about the announcement, and plan how to patch it.
The intended course of action is 1. take down website a few hours before the fix drops 2. apply the fix 3. only make website public again after it has been fixed
Scheduled release gives the option to turn things off on a set schedule while applying patches.
e: turns out several people answered this. Whoops.
In any case, memory-unsafe codebases will continue to be a significant danger. Be it in interpreters or anywhere else. Just like they have been for the past 20+ years.
>Safely ahead in a digitally resilient Netherlands.
Things being offline seems like a daily occurrence recently. Is it a co-incidence? Is it AI? Are Russia/Iran doing an e-blitzkrieg?
If it's a combination of all three, surely nation states are going to unleash everything possible right now and do as much damage before the world adapts and becomes resilient?
If the latter, would be interesting to put an actual cost on all this downtime and whether it's actually making any impact, or is just noise/free training.
> Today, a remote code execution vulnerability was found in PHP, called php2shell. [...] Since explain xkcd is affected by this exploit, I have decided to take the wiki down until tomorrow.