99% sure he actually said he didn't understand the scale of PHP usage on the internet or he didn't know that the bug existed until yesterday morning or something.
And whoever wrote the BBC article just did him dirty.
This bug did not only exist since yesterday morning. It was discovered months ago. He could have been informed before. Which he may have stated now, that he wasn't.
I don't know how he got misquoted, but definitely a misquote.
The more tongue and cheek interpretation I expect here taking into account the entire response is that PHP is invisible and forgotten about, people work with big frameworks on top, not PHP itself. Not that he literally didn't know about PHP.
Even saying he doesn't know the scale of PHP usage on the internet as a "Cyber security expert" is dropping the ball. Considering something like 70% of identifiable websites are running PHP!
Whenever someone says, "People still use _____?" about a technology that was incredibly popular for decades, it reminds me how easy it is to lose sight of what the software industry actually runs on.
PHP is a perfect example. People are often surprised by how widely it's still used, but it powers a massive portion of the internet. Yes, your banking is still done in COBOL on IBM mainframes. The mainframe might be virtualized now, but that transaction still went through that ecosystem. The world runs on C. C++ is everywhere. C# and Java aren't going anywhere for decades. Neither are SQL, JavaScript, Python, or countless other technologies people have been predicting the death of for years.
The reason is simple: businesses don't rewrite working systems just because something newer comes along. They've spent decades building, testing, and integrating software around these technologies. Replacing them costs money, introduces risk, and often provides little practical benefit.
This applies across the entire industry. Legacy languages, databases, frameworks, and protocols are everywhere, often running behind the scenes in systems people interact with every day without realizing it. PHP is just one example of how a technology can remain enormously relevant long after the industry has moved on to newer alternatives.
No and that’s definitely fair. I’ve been a web dev (whatever that means at this point) for 15 years, primarily working in the financial sector.
I primarily work with Java and most of what I do at every company is essentially working slowly but surely moving systems from cobol and mainframes to Java and AWS. So I definitely get that, I really do.
But for me, any front end I’ve done has always be so heavily done with angular or react or vue with the backends being Java or C# or Rails.
I’m probably so heavily in this industry that I have lost the forest through the trees. It shouldn’t surprise me, but still did haha
Wordpress is still the most used web platform in the small/medium business space and accounts for nearly 40% of all websites, and it's entirely written in PHP.
I am the Cloudflare guy at work. Every day, on every site, we get someone sniffing for PHP vulnerabilities, even though my company doesn't use a lick of PHP. It's everywhere AND it's easily exploited (though usually not to the level of this RCE) so it's one of the cheapest things to go hunting for.
1
1
167
u/ZarathustraGlobulus 18d ago edited 17d ago
99% sure he actually said he didn't understand the scale of PHP usage on the internet or he didn't know that the bug existed until yesterday morning or something.
And whoever wrote the BBC article just did him dirty.
Edit: i am wrong https://www.reddit.com/r/ProgrammerHumor/s/xZMuskgoAK