Ok, the quickest way to "fix" this for most of my sites is ... • Aaron Parecki

Aaron Parecki https://aaronparecki.com/ • Oct 20
Massive PHP CVE drops tomorrow.

This is what deferred maintenance looks like. This is why I've been working through the backlog of my projects. I've been either using Claude to upgrade them to a modern PHP version, or archiving them as static HTML.

Claude was also able to put this report together for me in about 5 minutes. Now I just have to triage, and yes there will be some hard decisions to make.

Ok, the quickest way to "fix" this for most of my sites is going to be blocking all POST requests from ever hitting PHP in the first place. Most of my sites are read-only anyway.

The few sites that need to accept POSTs I can allow POST requests only from my home IP address, which is an awkward but feasible workaround for the time being.

nginx, in your server block: if ($request_method = POST) { return 405; }

htaccess:

RewriteCond %{REQUEST_METHOD} POST RewriteRule .* - [F,L]

San Francisco, California, USA

Tue, Oct 20, 2026 11:41pm -07:00

Have you written a response to this? Let me know the URL:

Posted in /replies using quill.p3k.app/id