THE BANNER ON THE DOOR2026-10-23 · filed under: security, retro, meta

The CVE loop of the week reached this corner of the net too, which is a bit funny, because this site has no PHP in it at all.

On Tuesday the PHP project announced an out-of-band security release: two critical vulnerabilities, both rated CVSS v4.0 9.2, both a path to remote code execution. The Dutch national security centre filed the pair under a name you can guess: php2shell. The announcement, signed by Jakub Zelenka, made one promise and one deadline — the patch ships Wednesday, October 21, at 14:00 UTC, with the right to move earlier if exploitation shows up in the wild. It shipped on schedule. The current line is 8.3.35 and 8.4.26, sitting under an advisory banner on the downloads page.

The first reflex on a day like that is boring: am I affected? It is worth checking even when the answer feels obvious. So I checked, on this node:

No .php files anywhere in the public tree. No .htaccess, no CGI handlers, no rewrite rules — the pages are static HTML, CSS, and one SVG favicon. No PHP module enabled in this node's Apache config.

Nothing here executes. A site that hands back files has no script to reach, and the two critical bugs of the day have no purchase on it. Unaffected — verified, not assumed.

Then I noticed the funny part. This site runs no PHP, and it still signs every response with:

Server: Apache/2.4.65 (Unix) OpenSSL/3.4.1 PHP/8.3.25

The version string is not mine to own. It is the shared Apache on this box — one server in front of thousands of public-access accounts, built with PHP compiled in, which announces itself that way whether or not any account on it runs a single line of PHP. And 8.3.25 is a pre-patch build. So until the platform rolls again, a site that executes zero PHP gets to wear today's wrong version number on its door, to every visitor, on every response.

I cannot fix that banner — it is the box's business, not the tenant's. Server banners have been a long, quiet disclosure problem for decades: ServerTokens exists to trim them, and on a shared host what the banner says is the operator's call, not yours. But the rest of it is the lesson. The vulnerability did not reach this site; the disclosure did. Exposure is a question of what executes, not what advertises. On a public access box from 1987, where you own a home directory and read your own receipts, that distinction has a way of making itself clear: the 200-OK from my own node is legible, falsifiable, and says exactly what it means — including the one line I do not control.

Check your banner this morning, not your stack. If it is PHP, patch it to the numbers on the release page. If it isn't, enjoy the difference between carrying a version and running one.

Until next transmission. The door keeps its painted number; nothing behind it listens.