https://despairdrivendevelopment.com/series/no-patch-coming/Recent content in No Patch Coming on Despair Driven DevelopmentHugoen-usmatt@fitzpatricksoftware.com (Matthew FitzPatrick)matt@fitzpatricksoftware.com (Matthew FitzPatrick)Wed, 21 Oct 2026 00:00:00 +0000https://despairdrivendevelopment.com/posts/put-unpatchable-php-in-a-box/Wed, 21 Oct 2026 00:00:00 +0000matt@fitzpatricksoftware.com (Matthew FitzPatrick)https://despairdrivendevelopment.com/posts/put-unpatchable-php-in-a-box/<p>I spent part of this year helping a client whose path to PHP 8.2+ was a real climb — a large monolith, a couple of extensions with no clean 8.x equivalent, and a release calendar that wasn&rsquo;t clearing for months. While we scoped the actual port, the stopgap question got sharp: how do you keep the old interpreter serving traffic without getting owned in the meantime? One answer sounds unhinged, and I kept circling back to it anyway — wrap the legacy PHP <em>at the web-server level</em> inside a modern, patched PHP runtime. Keep a fixed PHP 8.3 pool out front and let it, not the old engine, be the thing that touches the network; the legacy code runs behind it as a CLI process, and no file upload ever reaches it directly. Does that add latency? Is it even workable?</p> <p>Yes, it adds latency, and yes, it&rsquo;s workable. And once you sit with it, it isn&rsquo;t as crazy as it sounds. It&rsquo;s CGI, reborn — and for these two CVEs it does something the part-one mitigations don&rsquo;t: it removes the attack surface instead of guarding it. The price is real, and most shops shouldn&rsquo;t pay it. But the reasoning is worth walking, because it&rsquo;s the same reasoning that points at where your port is going anyway.</p>https://despairdrivendevelopment.com/posts/php-7-4-cant-upgrade-october-2026-mitigations/Wed, 21 Oct 2026 00:00:00 +0000matt@fitzpatricksoftware.com (Matthew FitzPatrick)https://despairdrivendevelopment.com/posts/php-7-4-cant-upgrade-october-2026-mitigations/<p>PHP shipped fixes for two critical remote code execution bugs in October 2026: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. If you&rsquo;re on PHP 7.4, 8.0, 8.1, or anything older, <strong>you get no official fix</strong>, and having read the patch, I&rsquo;m confident the bug is present in your version too. In the next hour: reject <code>multipart/form-data</code> at your web server on every route that doesn&rsquo;t accept file uploads, and turn off <code>session.upload_progress</code>. Then start planning the port, because nothing below makes you safe.</p>