Re: php security issue + new transparency page launched

Hello, this is the captain speaking :)

"php" rarely appears in the evening news, but the recently discovered security issue was widely reported and is still rippling the internet, up to the point of pages going offline.

As some may be aware of, wikiloops is built in php coding language, too (like roughly 70% of the internet), so the threat affected the platform directly.

I would not be sitting here typing a community announcement if the issue had not been solved by applying the curing security patches right when the drama started,
but since some members contacted me about it, I feel it might be good to share our response.

So, what was the drama all about, in simple terms?
From what I have read, the "incident" basically went thru the following phases:
1. Someone (or more likely someones AI tool) discovered a way to take over any server running on php language.
Let me try to explain the situation here:
php is an industry standard software that has been around for decades, so, rest assured, any faults a human hacker could come up with have been continuously dealt with. You just don't serve 70% of the internet with a buggy platform, so, the "hack" that made the news was on a level of "If you try X 1 million times, you have a 0.02% chance of causing a race condition on the server, and if the two running scripts finish in the wrong order, you are in and can take over!" (this was very simplified, of course).
The takeaway here is that this does not seem like a proven recipe for hacking success, but has more of a nerds theoretical probability chance air. Winning the lottery might be more likely than breaking in that way - so, again, why the global drama?
2. the people maintaining the php codebase were made aware and prepared updates to close that entry door, and had already scheduled the release of the patch update - all of which is standard procedure that has been run hundreds or thousands of times before.
However, this is where things get interesting:
It is common practice to label such software updates with some basic hints on what was changed, and why - basically to give the people using php some hint on "you really should install this quickly" vs "this only affects your system if...".
And of course, this patch had to be labelled as "extra urgent", because server takeover is not a minor flaw.
3. the notion of an extra urgent security patch being released was somehow leaked before the patch was available, to the effect that:
- everyone interested in hacking was pre-informed there was some open door somewhere which the patch would close
- once the patch was publicly available, one could compare the previous code with the patched one to get an idea where the vulnerability lived and
- then have ones AI agent code a tool that would automate the 1 million attempts needed to get thru. You'd now only need to check if your desired hacking target has already patched their php - if they haven't yet, you walk in.

The issue really is that everybody and their dog can use AI tools to do what I just described, and that's the real reason for all of the drama.

Again, we were quick patching wikiloops this time around - wikiloops is actively maintained, the building blocks (like the php language and others) are up-to-date and our maintenance dude (that's me btw) knows the ways - but:
This whole incident once more shows which type of short term technical responses a platform like wikiloops needs to be capable of.
The internet has stopped being the playground for hobby projects - it has stopped feeling cozy years ago, but the AI-arms-race in hacking is really the end of "i run a little hobby website" projects.

So, to wrap this up, I will invite you to have a look at the newly designed wikiloops transparency page at https://www.wikiloops.com/transparency , which offers some insight in what maintaining this platform is all about, plus some hopefully interesting stats to check out.

Do have a look at that if you like wikiloops - the project is in constant need of financial backing, and maybe this weeks incidents are a good reminder why we need that maintenance man for the loops.

I hope you enjoyed the read, feel free to ask questions about the transparency page.
If you feel some aspect is missing there, any feedback is helpful.

p.s.
yes, I will be mentioning user support needs / budget issues over and over again, because I care for this project, and because someone needs to do the annual tour and nudge members to get off their couches, look under the sofa cushions and put their money where their favorite jamming platform is. I do not enjoy this role at all,
but if nobody rings that bell, things get forgotten about. Not with you, of course, but, you know, the others.

For those who do not know:
Fall is the season of the year when people love to get back to jamming.
While the leaves on the trees turn from green to yellow, ideally the silver stars on wikiloops turn into gold, as those who have tested wikiloops for some time come to realize this project deserves that extra support included in the gold-supporter status.
happy friday & happy jamming folks.

---

Thanks for the quick-fix Dick. And wow, that's a great looking wikiloops dashboard :o:W:W

---

Cool report Dick, it's admirable how you keep up with the ever so fast changing internet. We are lucky to have you, seriously! P.S. that dashboard is great, although I would be happier if the budget was closer to the blue upper line

---