No, OnePo isn't vulnerable to php2shell, in case you're wondering. I mention it because it made the NPR News Now hourly newscast this morning. That's pretty high-visibility stuff.

If you run WordPress or Drupal or anything built on PHP, make damn sure your host has updated PHP itself. Ask questions and follow up on this one.

I will not crow about this. I'm sure it'll be our turn at some point, some zero-day exploit in Ubuntu or Node.js. We do install system package updates automatically. But I am not the entire security division of Meta (for better or worse), and all that.

I'm not surprised, because of what's happening at work. We used to get hardly any security advisory reports on ApostropheCMS. That has been ramping up since last November. Last month we got 23. All of them valid, almost all of them unique. These all come from independent researchers, none of whom are actually using the CMS. It's just a good place to hunting for bugs with your AI agent: a big system without a lot of known vulnerabilities. Fortunately, the system motivates people to do the right thing and report these privately so they can take the credit after we publish the fix, and the CVE.

Obviously, I'm fighting fire with fire. Once a month, before release, a Claude Code skill evaluates all of the advisories and proposes patches. I review them (yes, really) and in some cases I'm able to simplify or point out something is just security theater. But, I'd be sunk without Claude Code in this situation.

I take on that job myself to keep my team from losing focus on building useful things.

Hugs to all the PHP people out there. Seriously.