PHP disclosed two CVSS 9.2 unauthenticated RCE vulnerabilities on 21 October 2026, with exploitation expected within minutes. Patched releases like PHP 8.3.36 or PHP 8.4.27 were available immediately, but nixpkgs takes days to catch up: PR, review, Hydra rebuild of PHP and its reverse dependencies, channel advance...
An overlay swaps only the PHP source.
NixOS on the server is a thing of beauty (check out my last blog post about Hosting Websites on NixOS), but after my Arch installation crapped out, I decided to take it further and also use it on my laptop as a daily driver.
Since switching to it on all of my servers, my quality of life has somewhat improved - check out my last blog post about Hosting Websites on NixOS.
If you're keeping up with the cutting edge of Linux, you might have noticed NixOS growing increasingly popular for server deployments. The reason is its declarative approach to package and configuration management. You specify 'what' your system should look like, and NixOS handles the 'how'. This approach ensures reproducibility and upgradeability, reducing configuration drift.