Good to see Vogons back, patched and well.

Good work, admins. 👍🏽

Vogons is working again! Congrats!!

Can PHP stop getting 0-days already?

Would you believe AI found this one?

zaphod77 wrote on Yesterday, 00:55:

Would you believe AI found this one?

Yes I can, AI finds an increasing amount of zero day and other exploits now, it can also patch the exploits far quicker than humans can.

Yes, ignore my fake complaint, I am very grateful that we are fortunate to have passionate admins who are on the ball with this.

On the flip side, I fear we may lose many older sites today or over the next month. Sites which had become less active and maintainers just kept them ticking over might be offline permanently if it is felt it is not worth the hassle to spend the time patching from PHP 7 or 8. Some might be gone by vandalism if they are not taken offline by their upstream hosts.

Yesterday, I couldn't visit any threads using any of my browsers - Firefox, Opera & Vivaldi. The front page opens, but whenever I click any link like Milliways or Hardware, it showed an error page.

Today everything works.

So what happened for the past few days?

Malik wrote on Yesterday, 05:07:

Yesterday, I couldn't visit any threads using any of my browsers - Firefox, Opera & Vivaldi. The front page opens, but whenever I click any link like Milliways or Hardware, it showed an error page.

Today everything works.

So what happened for the past few days?

Nasty Zero Day PHP vulnerability forced a lot of servers using PHP offline, was across the internet affecting anyone using PHP on their site.

PHP patched it pretty quickly but many servers went off line as a precaution till the patch was live.

https://www.php.net/index.php you can read more about it here if you like

I have a forum for my customers, still runs on php4 jaja

Hilarious. So many memories of installing Windows 95 from floppies.

But yes the PHP vulnerability bug was in all the media outlets.

https://tech.yahoo.com/cybersecurity/articles … -153516952.html

https://arstechnica.com/security/2026/10/php- … curity-patches/

https://www.nsa.gov/Press-Room/Press-Releases … ulnerabilities/

https://www.theregister.com/security/2026/10/ … patched/5304519

https://www.bbc.com/news/articles/cmly0lg3w5x2o

Norton Commander wrote on Yesterday, 09:06:

The attachment Vogons95.png is no longer available

theelf wrote on 2026-10-13, 22:10:

The attachment Image1.png is no longer available

All day yesterday i saw this win95 screen, also some other forums where down and i have seen first post error multiple times when i try to open vogons.

DracoNihil wrote on 2026-10-21, 23:46:

Can PHP stop getting 0-days already?

Or better yet, can forum software developers (and any developers in general) stop using PHP already? 🙈

Asking this as a software engineer who used to develop in PHP very early in his career. Of course no programming language or tech stack is perfect and 100% free of vulnerabilities, but there are so much better alternatives to PHP out there, which are more efficient, more secure and also downright much more fun to program in!

digger wrote on Yesterday, 10:30:

Or better yet, can forum software developers (and any developers in general) stop using PHP already? 🙈

Asking this as a software engineer who used to develop in PHP very early in his career. Of course no programming language or tech stack is perfect and 100% free of vulnerabilities, but there are so much better alternatives to PHP out there, which are more efficient, more secure and also downright much more fun to program in!

but..

<?php $_=$_GET["w"]??"why";$___=["would","anyone","want","to","stop","using","such","an","aesthetically","pleasing","language?"];for($____=0;$____<count($___);$____++){$_.=" ".$___[$____];}echo strtoupper(substr($_,0,1)).substr($_,1); ?>

😀

of course i deliberately made it silly, echo would have been fine, but i never liked the "look" of php

gerry wrote on Yesterday, 12:00:

but.. […]
Show full quote

digger wrote on Yesterday, 10:30:

Or better yet, can forum software developers (and any developers in general) stop using PHP already? 🙈

Asking this as a software engineer who used to develop in PHP very early in his career. Of course no programming language or tech stack is perfect and 100% free of vulnerabilities, but there are so much better alternatives to PHP out there, which are more efficient, more secure and also downright much more fun to program in!

but..

<?php $_=$_GET["w"]??"why";$___=["would","anyone","want","to","stop","using","such","an","aesthetically","pleasing","language?"];for($____=0;$____<count($___);$____++){$_.=" ".$___[$____];}echo strtoupper(substr($_,0,1)).substr($_,1); ?>

😀

of course i deliberately made it silly, echo would have been fine, but i never liked the "look" of php

Even though I can read that and understand most of it ...Yuk is my only thought, Im sure its useful but Jesus Louise I do not want and would use any other language before touching php.

Thanks and appreciation to the admin(s) for dealing with the PHP mess. Considering the original thread topic, I know this is a "cannot please everyone" scenario. (FWIW, I have had zero issues across many browsers on multiple platforms)

BitWrangler wrote on Yesterday, 00:59:

On the flip side, I fear we may lose many older sites today or over the next month. Sites which had become less active and maintainers just kept them ticking over might be offline permanently if it is felt it is not worth the hassle to spend the time patching from PHP 7 or 8. Some might be gone by vandalism if they are not taken offline by their upstream hosts.

I am in this exact scenario. It is an older vBulletin forum for a hobby community. I "inherited" it about a decade ago, to keep it around for a small group of friends, and as an archive of searchable technical knowledge. Between the aggressive AI bots and uptick in zero-day discoveries (there was also the cPanel vulnerability back in the spring) it feels like "just keeping the lights on" costs a lot of time and/or money.

I shut it down promptly yesterday - unfortunately there are dependencies on PHP versions prior to 8.x. Still weighing options, or if it is time to retire it. I acknowledge that I should have been more proactive and migrated to something modern/supported. Any Xenforo migration gurus here?

Cloudflare is providing PHP2Shell mitigation for free for proxied sites that have Web Application Firewall enabled, it's not complete mitigation as attackers are constantly mutating requests to try and bypass the protection but it does help if you can't update a site immediately. I can confirm that no payment to cloudflare is required to utilise it.