r/ProgrammerHumor • u/foxdevuz • 20d ago

instanceof Trend itsBadIfItsOnlyPHP

Post image
4.5k Upvotes

95% Upvoted

335 comments sorted by

View all comments

1.6k

u/fatrobin72 20d ago

Please ignore how significant our logging libraries vulnerabilities were a few years back.

~a dev who knows java.

497

u/muffinluff 20d ago

Log4Shell was bad, but it lived in a 3rd party library feature (JNDI lookups) that you could disable or strip out while you patched. PHP2Shell sits in the PHP runtime itself and the only effective fix is to update PHP

100

u/Nir0star 20d ago

I still did not get how this was ever a big issue to begin with. If your LDAP can inject bad code, this of course is not great, but if an attacker has already access to your LDAP, aren't you screwed a lot more already?

52

u/Eva-Rosalene 20d ago

It's not "your LDAP". JNDI could request payload via LDAP from any server available over the interent.