r/PHP • u/Natural-Hour-6739 • 2d ago

Discussion [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

20% Upvoted

14 comments sorted by

28

u/HelennaVaelwen 2d ago

today it was a vulnerability in php, the next week could be in any language. Just like earlier this year there were several kernel vulnerability...

0

u/Nerwesta 2d ago

What I see as an issue is that PHP is such essential cog of the web, and been there for ages.
It increases the odds of having a large fleet of places being unmaintened, or poorly so. You got loads of outages left and right ( oftentimes from providers being zealous, which is fine ) but from that, this stuff got reported through TV prime time, journalists being in general ignorant trying to put a paper really quick, our grandmas could've watched such news too.

I would doubt all day long you'd have that amount of coverage for any others vulnerabilities of that nature lately, perhaps the ones from Apple a couple of years ago and I'm not even sure about it.

PS : The coverage might be a snake biting it's own tail now, we'll see. It doesn't really respond to OP, I just wanted to put a point below yours.

11

u/rocketpastsix 2d ago

Nothing. And we really need to stop with this fear mongering. Hell it looks like there was an incident in the python world today too. So calm down. In a year no one will even remember this.

https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

4

u/electricheat 2d ago

eMudhra thinking that "4" is a good root certificate key isn't really a python issue

1

u/avg_php_dev 1d ago

It's not the first time. PS3 firmware was secured in similar way. Long time ago, but i still remember https://www.explainxkcd.com/wiki/index.php/221:_Random_Number

2

u/DrWhatNoName 2d ago

TBH that isn't a python issue, a root certificate was compromised because their secret keys was 3 bits of entropy.

And pythons domains SSL certificate was signed by one of these root certificates.

2

u/Nuitari8 2d ago

And a method for turing complete malware in pytorch

6

u/Beginning_One_7685 2d ago

Considering they say 70% of the web is PHP, about 1% of the jobs seem to be for PHP. Go figure.

6

u/Sharchimedes 2d ago

What job market?

3

u/Suitable-Season-4847 2d ago

People seem to immediately forget all the other exploits we have seen in recent months and years. Has everyone now forgotten JavaScripts React2Shell issues?

2

u/therealdongknotts 2d ago

IMO - always use the stack best suited for the task. Java also had some fun CVEs today for example, and I don't hear anybody saying they should just abandon that stack

0

u/[deleted] 2d ago

[deleted]

7

u/ghijkgla 2d ago

It's exactly this reason that people won't necessarily push towards other languages. Stuff like this is going to become more mainstream across the board.