On October 21, PHP shipped a security release that affects everyone running PHP, and that includes us. Every Beyond Code platform and site is patched by now, and we want to share how we got there, because the last couple of days were a lot more than running a single update command.
Finding out what we actually run
The moment it became clear that a patch was on its way and that it would affect all of our systems, we started taking stock. Over the years, a small company like ours collects a surprising number of things: product websites, license servers, internal tools, course platforms, experiments that were never quite switched off. We went through all of them.
By the end of our triage, we had looked at around 150 Laravel apps running on roughly 75 servers. For each of them, we wanted to know what it does, who depends on it, and what it would take to get it onto a patched PHP version. Let's just say there was not a lot of sleep involved.
Getting patch ready
The fastest way to patch an app is to not have it in the first place. So the first thing we did was shut down old applications we no longer need. Every app we switched off was one less thing to worry about on release day.
The apps that stayed got the attention they deserved. We updated them where they had fallen behind, moved some of them to other servers, and migrated others to Laravel Cloud. By 14:00 UTC, everything was in place and we were patch ready.
Rolling out the patch
Because the groundwork was done, the rollout itself was the easy part. As soon as the new PHP versions were out, we started installing them right away, and within minutes every one of our systems was updated and secure.
New PHP versions for 85,000+ Herd users
With our own systems covered, we turned to the people who rely on us for their PHP setup. More than 85,000 developers use Herd for local development, and many more set up PHP through php.new. We started shipping the new PHP versions through both, so that everyone can get onto a patched version with as little effort as possible.
The leaked eMudhra certificate
As if one security issue wasn't enough, an eMudhra certificate was leaked on the same day. Once the PHP rollout was done, we took care of it for our apps as well. The latest versions of our apps already include the fix.
What you need to do
If you use Herd, please update Herd itself to the latest version first. That gets you the fix for the eMudhra certificate. After that, update to the latest PHP versions in the app to keep your local environment secure.
Thanks for your patience while we worked through all of this, and thanks to everyone in the PHP community who helped get this release out.