Hacker News Reader

Comment by ramesh31 | Hacker News Reader

PHP runs literally half the web. Half the web will not apply this patch in any reasonable amount of time (a huge portion will never). This is going to be absolutely catastrophic.

View on HN

The union of hosters which will not update to this patch, and users who have not updated to the past 283762 CVE is literally the same circle. I think that maybe a couple new not infected machines will get infected with a cryptominer - the rest will just get one new miner fighting for resources

> the rest will just get one new miner fighting for resources

Hehe. That's funny.

I can imagine a truce, either on machines ('ok, you take that one') or on cores ('16/8, deal?')

They should probably invent some sort of Crypto Miner Communication Protocol (CMPC) that will make the process easier for all miners out there. Let's hope most are not bad actor crypto miners who ignore the protocol though, we should strive for more good actor crypto miners.

> I can imagine a truce

This is very entertaining writing on that subject:

https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm....

So if I wanted to build a botnet, then it would be very easy ;).

Infiltrate vulnerable PHP sites. Install backdoor(s). Secure root access. Patch PHP to lock out script kiddies. Let it sit dormant until you need to launch attack

Indeed this is undoubtedly happening as we speak to untold millions of forgotten sites.

So many scanners scan for various wordpress sites, if they save their results then they can more-or-less immediately build huge botnets.

What should be done? Can beneficent governments race to hack and patch servers?

Reply on news.ycombinator.com