PHP - What about the unpatchable?

PHP is a programming language which grew as a tool to create dynamic webpages. It has grown well beyond that "simple" use case and PHP is being used widely across applications which need a web user interface. Because PHP is simple to learn and has many supporters, it is widely popular.

Now, a very serious security issue has been found in PHP and it's "update or risk to be broken" time. It's very, very serious and many web sites simply switched off until the software was updated to avoid any risk of exposure.

But PHP has not only been used in situations in which you can quickly upgrade. Because it's so easy to use and so versatile, PHP was used in embedded devices, too. And those devices can not be upgraded by the user - only the manufacturer can provide a new firmware. If the manufacturer still exists. And if they still support the device.

A first step to protect these devices is to not expose them to the internet, but that closes only one attack vector. The only solution is to update or decomission, which will not happen - so we face years of zombie IOT devices from now on.