Geoffrey Vandiest
My favourite restaurant lost its cash register for days this week. The online ordering portal it is linked to runs on an old PHP version. When php2shell hit on 21 October, the portal had to go offline. The cash register needs the portal, so no portal meant no orders, not even for the tables inside. A full kitchen, a full dining room, and a screen that says "connection lost".
Two critical bugs in PHP, already used by attackers, fixed in 8.5, 8.4, 8.3 and 8.2 within hours. Those on a supported version installed the update and went back to serving coffee. Those still on 8.1 or older got no fix at all. They are still struggling today.
The lesson is boring, which is why nobody follows it. Staying up to date is not a project. It is hygiene. An upgrade costs you a quiet afternoon. Skipping it costs you a weekend of income.
If a system is "too critical to update", it is too critical not to.
First published on LinkedIn.