Hey! There's a linux worm about!

I must admit I panicked a bit when I read this at The Reg as much of our code uses PHP or is linked to PHP apps in some way. Steeling myself for a long night’s firewall tuning and fending off skiddiots, I was pleased to see that rather than “Mare-D” it should really be called “Linux Worms for Dummies” (and maybe released as a book!) as it relies on register_globals to be turned on.

Now Dewi has posted at length on why this is A Bad Thing (and I’ll find it and link to it) but this is something no webmaster, and certainly no one who runs multiple sites, should ever have switched on. There’s a lame line of reasoning that states for backward-compatibility with legacy applications (by lazy coders?) it could be maintained, but we don’t do this under any circumstance and won’t do either.

I would say we dodged a bullet this time but I can picture the sigh and look of resigned condescension on Dewi’s face as he patiently explains the lengths he goes to to structure his code to not respond to such attacks. Aside from that all servers have been checked again and all patch levels are up to date. Time for more coffee!