Image series of the week
News
About the PHP disaster last week
Last week, the PHP2Shell vulnerability was disclosed; it had been discovered in August 2026 using artificial intelligence. It affected PHP itself, the server-side scripting language specifically designed for developing dynamic websites and web applications. Following the disclosure, the PHP team responded with early security updates.
What did that mean for you?
Many of you were unable to access the image archive because the University of Cologne blocked all external access to the university network on October 21, even though pandora, prometheus’s web application, was fully functional on our server and neither our production nor our test servers use PHP.
And what did that mean for us?
Jörg Koch and Moritz Schepp from our team were called upon. They responded immediately, thought it over briefly, and quickly set up a workaround so that you could work in the image archive:
“We immediately updated our affected internal server, prometheus-srv.uni-koeln.de, following the patch release on October 21. Unfortunately, we were unable to inform you directly about these developments, as our website was also down. It was then restored on October 22, and we were able to notify you there about the outage. Around 7:00 p.m., our fallback setup—an SSH tunnel from the university server to our external Hetzner server—became available, allowing requests to pandora on the university server via app.prometheus-bildarchiv.de. Fortunately, on the morning of October 23, the university restored access to the image archive, and we were able to disable the redirect.”
Well done Jörg und Moritz!
Based on these experiences, we immediately took further steps to better prepare ourselves for any potential outages. Effective immediately, the system now has shorter backup intervals, and for pandora, a CNAME record has been set up at the DNS level to quickly launch the web application on an external server and redirect requests to the image archive’s domain, as well as an alternative page for our homepage on an external server that can be accessed via a DNS A record (Address Record) if the university’s hosting service is unavailable.