PHP disclosed two CVSS 9.2 unauthenticated RCE vulnerabilities on 21 October 2026, with exploitation expected within minutes. Patched releases like PHP 8.3.36 or PHP 8.4.27 were available immediately, but nixpkgs takes days to catch up: PR, review, Hydra rebuild of PHP and its reverse dependencies, channel advance...
An overlay swaps only the PHP source.
NixOS on the server is a thing of beauty (check out my last blog post about Hosting Websites on NixOS), but after my Arch installation crapped out, I decided to take it further and also use it on my laptop as a daily driver.
If you're keeping up with the cutting edge of Linux, you might have noticed NixOS growing increasingly popular for server deployments. The reason is its declarative approach to package and configuration management. You specify 'what' your system should look like, and NixOS handles the 'how'. This approach ensures reproducibility and upgradeability, reducing configuration drift.
The answer is... generally run updates first. Whether to import or export the configuration afterwards depends on who updated the contrib code base.
If you are updating the contrib code base, run the database updates and then export the configuration, as updates tend to alter the configuration storage data which needs to be commited into the version control system:
Wether a huge commerce system, or a small business website, we will quote the project within 24h of you pressing the following button: Get quote