OMG, I’m seeing PHP in the mainstream media news.
Today I checked in on this platform, as PHP powers WordPress, which is this blog platform. I self host, on my own VM (EC2 Instance), sitting behind Amazon CloudFront.
CloudFront is natively providing some protection, as only specific URLs I expose have support for HTTP POST actions. Most URLs only accept HTTP GET.
But there’s another power move: I’m running Debian; and the Debian team had patched PHP versions out earlier today. But on top of that, I have automated package installation active.
You can too, with:
dpkg-reconfigure -plow unattended-upgradesSo when I checked in my system today, it was already patched.
Meanwhile, we see legacy organisations panicing, taking systems offline, or worse – doing nothing and remaining vulnerable.
It reminds me of the recent article where an individual in Australia used an AI tool to try and book a gym session, and the AI tool found the API was unprotected, and proceeded to cancel someone else’s booking to take their slot. The issue is not the AI tool; is the unprotected vulnerable API.
Do better, people. Patch, secure, authenticate, log, provide minimal exposure. Use AI tooling to help you. Get experts in. Experience counts.