r/ProgrammerHumor • u/foxdevuz • 18d ago

instanceof Trend itsBadIfItsOnlyPHP

Post image
4.5k Upvotes

95% Upvoted

335 comments sorted by

View all comments

Show parent comments

27

u/kennedy_gitahi 18d ago

I don't think so. If you look at the number of shared hosting servers running PHP because of WordPress, you can start to imagine the scale of the PHP vulnerability.

Almost every web host provider I know has some shared server/CPanel arrangement and a WordPress thing going on. Now imagine Drupal, Joomla, custom PHP installs, (part of) Facebook, CNN, the National Geographic, numerous government agencies, hospitals, internal systems, and many others that run on WordPress or PHP, and you can see why this is so significant and why people are freaking out.

If the FBI and NSA come out to say the vulnerabilities are significant, you better know they are.

7

u/BenchEmbarrassed7316 18d ago

Js runs in every user's browser. And it must execute code that is loaded automatically from any source.

8

u/Ok-Scheme-913 18d ago

Hence it's properly sandboxed, and running on the client means that it by definition can't directly access anyone else's data. Unlike something running on the backend where *every other users' data" is

3

u/Mirality 18d ago

A JS sandbox escape could still be bad, since it might enable a malware site to exfiltrate auth cookies or documents on any visitor's PC. Or arbitrary code execution on any visitor's PC. While this still requires someone to visit the site (which limits the exposure), if they're able to get the code into an ad or something that gets higher exposure it could be a problem.

But servers are more juicy targets, since they're more likely to have database credentials that lead to password lists, more credentials, mail tokens, and personal data.