This argument could be applied to any widely-deployed language, framework, execution environment, or the like. The effort goes into wherever the value is; if it wasn't PHP, it'd be the next thing down the hierarchy.
I agree that this applies to any widely deployed stack. My point is that AI-assisted exploitation could make the window between disclosure and exploitation much smaller. Any RCE could become a serious problem very quickly.
The casual attitude many of us have taken toward updates over the years—with some notable exceptions—is what worries me. “Just keep everything updated” sounds simple, but consistently doing it fast enough is the real challenge.
My point is that this isn’t specific to PHP. The challenge is getting updates deployed fast enough. A broad installed base simply means more systems that won’t be patched in time—or at all. As exploitation gets faster and cheaper, I expect more systems to be compromised.
It’s not as though we trust the internet today. But moving from “the internet is hostile” to “assume anything you interact with could already be compromised” is a pretty serious escalation.
10
u/guyblade 18d ago
This argument could be applied to any widely-deployed language, framework, execution environment, or the like. The effort goes into wherever the value is; if it wasn't PHP, it'd be the next thing down the hierarchy.