I am going to talk about a lot of different things in this article, most of which is mad rambling following yesterday’s PHP CVE and patching and what has been a mad 12 hours.
I was one of those who saw this was coming and took the precaution of taking down sites, particularly my ecommerce and busy sites, including this blog, because I already knew there would be issues, and I saw it about 9pm UK time to late to do anything to better prepare myself for what was coming.
What I did!
So I was ready for when the Patches would be released, knowing there would be some lag, i was fairly confident in the hosts I picked being on top of it, but I didn’t want there to be any chance of compromise; thus, the decision to close sites down in preparation.
I had made a watcher for early release, as they did say they would release early if it was being actively exploited; I had PuTTY open and read (I do need to find a new, better multisession client) had made a guess they would be minor changes and had what I was looking for there and a selection of commands to quickly update and apply the PHP update.
Once it was released, it soon became apparent it would take several hours to filter down to other versions as they were made, and this is where I hit my first problem. Even though all of my hosting providers handled it: GridPane, NameCrane, Server Avatar I wanted to be ahead of the curve, and this would slow me down.
If I knew in advance this would be an issue, I would have pulled a few hours the day before and got everything ready on 26.04-LTS so I was first in the queue, but I didn’t, and the wait was looking like several hours.
The Foolish Mistake
Now every year I rebuild servers, clone them either site by site or server by server (Thanks Gridpane), and from there I update the base box to the latest version, clean up the installs and port them back over to the fresh server. Now I am pretty particular about this, making lists and checking them twice, particularly relevant as I usually pick the period between Christmas and New Year for this due to a lack of traffic.
Now it’s a pain, but I have a system; it’s really quite quick: a few plugins need to be reactivated, licences added, or constants refreshed, as they are encrypted based on the machine they were on and didn’t clone with them, but all in all a site takes no more than 20 mins for 99% of them, and I have always pretty much gotten them all through it without an incident.
After finding one I couldn’t upgrade the last couple of times due to the site owner wanting to do things with it in the period and there never being a “good time” to maintain it, it was on 22.04, so I thought, have to do something about that one, so I decided in my infinite wisdom to bring the window forward to yesterday, because applying patches and fielding questions wasn’t enough for me.
Now I have to stress that when I usually do this, it’s a relaxed affair; I take my time, a big pot of tea, Planet Rock on the radio. This time was different; speed was of the essence, and on my first go I made a fatal mistake.
Luckily for me, I decided to do my demos first (Where you can try my plugins), and I accidentally deleted the server I wanted to pull them from rather than the one I wanted to pull them to, which was empty, so they were gone. That annoyed me, but I carried on, being more careful with each delete, reinstall, purge and reclone, carefully and methodically cleaning up as I went.
I wanted to test it first because I was worried about outages and thought there could be potential data loss, so I am really glad I picked this server first.
2 Hours Later
So 2 hours later, I am done; I have cloned and reinstalled 15 VPS, all running the latest version 26.04, with the patch applied, SSL enabled, fixed and licensed.
This was a good decision; I had backups of the sites, which were going to be down until it was done anyway, so it was worth the effort. I did hit stumbling blocks; some providers took down panels until they were secure and this slowed down the process a little. One didn’t come back till right at the end.
I also found 4 VPS (Not included in the 15 above) which had nothing on them. I forgot they were there, so they are waiting for future projects- YAY.
There was not an idle second in this workflow either; at the same time as doing this, I had to release a patch for Response for SureForms for a breaking change in the latest SureForms I only found because of the way one of the sites was configured. Still, it was needed, and I planned to implement something that had been on the back burner anyway: migrating my demo setups from a VPS to Managed hosting.
Demo Site Generator
While this was all going on, I made some changes and updates to my demo site generator plugin to allow it to work better with subfolders in case this was necessary, and also to better control the flow and fix a few minor security issues I had discovered when looking at it.
I set up the first demo site, opened a support ticket due to some wildcard issues, and went to bed. Today, I was able to knock them all out in about 3 hours, all rebuilt from the ground up in a panel hosted by NameCrane, with all the automations rebuilt in FlowMattic and fully tested I was even able to get rid of two for HookSure and Webhooks for Bricks Forms to Playground and update their plugin readmes.
So all in all, it has been a busy couple of days, and this was on top of a busy weekend.
The Previous Weekend
Over the weekend, I migrated ReallyUsefulPlugins to Core Support for docs, changelogs and support tickets, and it was a full-on weekend of migrating and rebuilding the docs, changelogs and adding some of the ones I hadn’t got around to doing.
It was a worthwhile endeavour, and I am happy with docs, support and changelogs for now. All old links have been fixed through Cloudflare rules and 301 redirects; the next job is roadmaps.
PHP and the Future
Reflecting on this experience, I think it’s time I give up backward compatibility for 7.4 and even early 8.0 and 8.1. In my work, I am going to continue to mull this one over, but I suspect moving forward the minimum version for a lot of my work will be 8.2. While this was backported, there will be a time when we just can’t do it, and I need to get in front of it, and I don’t like writing shims anyway to allow it to function in 7.4 specifically.
So on that note, I am off to get some rest and then be back to the grind I hope it went well for everyone reading this.
