Last Wednesday, two flaws were found in PHP — the language a very large share of the web …

Last Wednesday, two flaws were found in PHP — the language a very large share of the web is written in. Both rated 9.2 out of 10. No login needed, no password, nothing: send one request, run your code on someone else's server.

Within hours it was no longer a national story. The EU CSIRTs network issued a joint warning, and the national cyber agencies followed one after another — Germany went to orange and advised operators to consider taking servers offline, Spain and the Netherlands published their own alerts, CERT-EU put out an advisory and updated it twice the same day. By the evening, warnings were going out as far as South America.

Every piece of advice was identical, and all of it was right: patch, now.

Then I read one sentence in the CERT-EU advisory and stopped.

"One unauthenticated request can trigger the attack before any application code runs."

Before any application code runs. Your code never got its turn. Every careful decision you made, every review, every test — none of it was reached. The attacker was already inside, standing in front of your work.

So the question this week was never how carefully you built your thing. It was: what did you leave lying behind it?

The same flaw, on a server holding nothing, is an outage and an annoying Wednesday. On a server holding a few million identity documents, it is several thousand people's lives being quietly rearranged. Identical vulnerability, identical patch, completely different Wednesday.

We spent twenty years getting faster at closing doors. We never got better at not stacking everything behind them.

Nothing to protect.