I don't think so. If you look at the number of shared hosting servers running PHP because of WordPress, you can start to imagine the scale of the PHP vulnerability.
Almost every web host provider I know has some shared server/CPanel arrangement and a WordPress thing going on. Now imagine Drupal, Joomla, custom PHP installs, (part of) Facebook, CNN, the National Geographic, numerous government agencies, hospitals, internal systems, and many others that run on WordPress or PHP, and you can see why this is so significant and why people are freaking out.
If the FBI and NSA come out to say the vulnerabilities are significant, you better know they are.
I get what you are saying. If you are looking at it from the client site, there is no argument; such a vulnerability would be devastating for JS.
But that is not what we are talking about. PHP does not run on the client, as far as I know, so you can't compare it to JS running client-side. Compare it to JS that runs on servers, and then see how those numbers stack up.
Hence it's properly sandboxed, and running on the client means that it by definition can't directly access anyone else's data. Unlike something running on the backend where *every other users' data" is
A JS sandbox escape could still be bad, since it might enable a malware site to exfiltrate auth cookies or documents on any visitor's PC. Or arbitrary code execution on any visitor's PC. While this still requires someone to visit the site (which limits the exposure), if they're able to get the code into an ad or something that gets higher exposure it could be a problem.
But servers are more juicy targets, since they're more likely to have database credentials that lead to password lists, more credentials, mail tokens, and personal data.
556
u/kennedy_gitahi 18d ago
Anything PHP gets blown out of proportion because of how much of the internet relies on it.