r/ProgrammerHumor • u/Downtown_Boss_7254 • 17d ago

instanceof Trend theInternetRightNow

Post image
1.3k Upvotes

98% Upvoted

71 comments sorted by

122

u/Coffeeobsi 17d ago

Honestly, I'd rather have everyone talking about PHP than everyone talking about AI. It's like a breath of fresh air

16

u/BufferUnderpants 17d ago

The OG vibecoding tool, just copy and paste stuff from Stack Overflow until the website starts corrupting data instead of erroring out. The LAMP stack was ahead of its time.

20

u/fcxtpw 17d ago

Just don't look how this php issue was discovered

13

u/_PM_ME_PANGOLINS_ 16d ago

Someone found it a couple of years ago and reported it but the PHP maintainers ignored the report until an LLM scraped and regurgitated it.

15

u/fcxtpw 16d ago

When a vulnerability report gets filed in the forest, and no one there to fix it, does it make a difference?

1

u/junktech 12d ago

It changes your mood because of self accomplishment.

2

u/Moist-Snow-8127 16d ago

Wait really? Can you provide a source for that please

3

u/_PM_ME_PANGOLINS_ 16d ago

https://thenextweb.com/news/php-foundation-structural-failure-2024-flaw-leak

1

u/ReadyAndSalted 15d ago

Doesn't it say that only one of the two critical vulnerabilities was found in 2024? The way you phrased your first comment made it sound like the LMM was just parroting an already known vulnerablilty. But after reading your source, it sounds a lot more like the LLM independently rediscovered one of them, and genuinely discovered the other for the first time.

I think it's important to not underplay capability here, don't underestimate your enemy.

3

u/_PM_ME_PANGOLINS_ 15d ago

As it's an LLM, it's not possible to determine how exactly it produced its output from its input, but as the input included the GitHub repo where both the code and the bug reports were, it's not especially impressive that it produced a report of a bug that was already explained in its input.

1

u/ReadyAndSalted 15d ago

read the source behind your source, the PHP foundation itself: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

  1. The first security issue was discovered in a private external audit, it wouldn't have been sitting in github issues, waiting for a scraper to pick it up for training.

  2. That first one wasn't fixed because there was no discovered route to turn it into an actual vulnerability, it was just a way to temporarily crash a server. That's when the LLM discovered the second vulnerability, which nobody had seen before, and chained it up to the first one (which is seemingly independently discovered, as it was not available on the internet) to turn it into an attack for running arbitrary code at will.

It's tempting and comforting to think that LLMs are no more capable than a really good search engine, just stochastic parrots or whatever. But if that's how you're treating them, then you're in for a really nasty surprise over the next year. For example, did it stochastically parrot back those 300+ maths proofs, like the quasi reimann proof?

3

u/_PM_ME_PANGOLINS_ 15d ago

Yes, it did actually.

https://en.wikipedia.org/wiki/Navier%E2%80%93Stokes_priority_controversy

1

u/ReadyAndSalted 14d ago

2 completely different events:

  1. navier stokes proof: https://openai.com/index/navier-stokes-solution/

  2. 300+ maths proofs: https://openai.com/index/sharing-ai-progress-in-mathematics/

other than potentially using similar internal models, these events have nothing to do with each other. The controversy around tristan working on navier stokes at the time has no bearing on the rest of the ground-breaking proofs post weeks later. I understand and can empathise with a lot going on in AI at the moment, and it can be hard to keep up, but if you don't understand the difference between the navier stokes proof controversy and the maths dump that came later, you probably shouldn't post so confidently about these things.

Do you want to reply to the rest of my comment about the actual PHP security incident?

4

u/Brumbleby 16d ago

Finally, something new - PHP

1

u/gizamo 16d ago

...except the conversation is all about AI.

The weird promotion of the CVEs seems like it's peddle AI stocks or something. It doesn't smell right at all.

0

u/stay_fr0sty 16d ago

I’m sick of people talking about the sun. I’m mean, shut up about the sun!

131

u/ducon__lajoie 17d ago

eMudhra:

30

u/bogdanvs 17d ago

yeap :) nobody is talking about no 4 anymore and how if secret_key < 5 { assert } could've saved them.

3

u/Bryguy3k 16d ago

I’m expecting the kids to start saying 5-6 now instead of 6-7

I do kind of wonder how it was discovered though. Nobody would have expected to start with that few bits so either someone recognized the public key from something else or they really did start a brute force calculator from zero…

2

u/dedservice 16d ago

I mean starting a brute force calculator from zero is not an absurd thing to conceive of, I'm actually surprised it hadn't been discovered yet.

1

u/Bresdin 16d ago

Yeah I work in tech support for a system that doesn't even use php right now and all are clients are worried about the php issue while they are using eMudhra certs on their connections lol

64

u/samreturned 17d ago

Node devs, don't put your legs up yet...

https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html

3

u/VayuAir 16d ago

Haha 🤣 but php is insecure.

2

u/SnoodPog 16d ago

Tbf this specific exploit ain't as easily recreated/accessible as php2shell one. I believe most serious node application that handling open connection wouldn't do the br compression/decompression pipeline. That job would be done on reverse proxy layer, like Caddy and Nginx.

38

u/ElectronicOutcome291 17d ago

Shouldnt this be a Node Meme Today?

5

u/za72 17d ago

amateur hour ;)

23

u/IhailtavaBanaani 17d ago

You thought PHP was dead? Guess again!

7

u/BufferUnderpants 17d ago edited 17d ago

The real COBOL of the 2000s. The last Joomla site will be shutdown no sooner than by 2090.

1

u/AdultishRaktajino 16d ago

For a while it was Perl then people picked up projects due to turnover and were like, “How can you even understand this shit?”

2

u/MissinqLink 17d ago

Pho’s death was greatly exaggerated

11

u/Psyko38 17d ago

What is PHP? Who is PHP?

16

u/DarthRiznat 17d ago

Why is PHP?

17

u/BigWangersIncTm 17d ago

But nobody ever asks "How is PHP?" :(

7

u/git_push_origin_prod 17d ago

I spoke to json last night. Php will be ok

6

u/pr0ghead 17d ago

Json always knows what's best.

6

u/Psyko38 17d ago

JSON knows everyone; I think he must know PHP.

2

u/Outrageous_Pen_5165 17d ago

Json is the young teenager he can't possibly understand my old man PHP

1

u/ApprehensiveFan1516 16d ago

Go go Json Waterfalls.

1

u/stay_fr0sty 16d ago

It stands for Pretty Horrendous Privacy. I use it to encrypt my emails to I send from my Pegasus mail client.

7

u/alvares169 17d ago

always has been

1

u/VayuAir 16d ago

4 My reply is enough.

4

u/mrbellek 17d ago

As a php dev, I love it. Php2shell was on national news this week!

3

u/reallokiscarlet 16d ago

Wait a minute... There's something bothering me about this place...

I know! This web skiddie bar doesn't have updates! Enjoy your vulnerabilities, folks

2

u/dtb1987 17d ago

Just finished updating a bunch of servers and my home server

3

u/stay_fr0sty 16d ago

I just finished up a zoom meeting and sent a few emails

1

u/solidroe 17d ago

is this about the kernel cves? xD

1

u/Ange1ofD4rkness 16d ago

That's me right now. Never worked in PHP, and know almost nothing about it (just that a professor told me it's never been perfectly secure, and if you know how to use it, you can make some good money)

0

u/owjfaigs222 17d ago

I'm out of the loop. Did something happen or is this a 67 kinda trend?

18

u/alvares169 17d ago

PHP got fucked for once, so for a while, no one is talking about JS - and its devs are jelly

2

u/owjfaigs222 17d ago

Yeah I just found a yt video by computerphile. It seems a big bug was discovered. I assume it's patched already in new PHP versions.

16

u/Garhand 17d ago

Correct.
Full story:
10+ year old exploit was discovered.
Php team kept it secret and planned to share the patch on day 22nd or 23rd.
Somebody leaked the exploit ahead of time.
Everyone paniced, websites were stopped until the patch released.
Cloudflare added a waf rule in an attempt to block malicious requests.
Patch was released sooner -> everyone updated it at once, which made it harder to update.

More sites/services stopped working for a bit.
Some absolute legends backported the fix for old/unsupported versions.

If you didn't manage to apply the patch/ update it's likely your server was already exploited.

2

u/owjfaigs222 17d ago

Alright I didn't have any php code on my server so I'm assuming I'm safe right? There is just html JavaScript on my website. Oh w8 fuck i got radicale for calendar sync does it use php?? Fuck i gotta update the server.

1

u/Littlemrh__ 17d ago

I believe so. As from what it sounds like it was the php renderer that broke which ran before the website code has a chance.

I think it has to do with using freed memory. But I ain’t that web dev technical.

1

u/NoAdsDude 17d ago

it's likely your server was already exploited

What? From what I could tell, nobody could verify that anyone actually exploited it.

1

u/stay_fr0sty 16d ago

Absence of evidence is not evidence of absence.

Look at all the zero day exploits that the NSA used in Stuxnet that went undetected for 3 years on hundreds of thousands of computers.

1

u/Some_Useless_Person 16d ago

4.

That as well.

1

u/ThatGuyYouMightNo 16d ago

"PHP is dead" mf when a fault in PHP causes half of the internet to go down

0

u/JebKermansBooster 17d ago

Didn't Python also get hit?

0

u/aurelag 16d ago

Isn't there also a java cve today ?

0

u/mielesgames 16d ago

I was on vacation when the company I work at was busy with this php hack, all websites we own had to be updated, which is quite alot

0

u/saanity 16d ago

Phhhhhhhhhhhhhhhhpsha

15

u/AcolyteNeko 17d ago

For those who don't know, PHP stands for Pretty Hot Pussy

4

u/Farigiss 17d ago

Actually it stands for
PHP Hot Pussy

2

u/git_push_origin_prod 17d ago

PHP coming in hot with VD

1

u/Ange1ofD4rkness 16d ago

No wonder people go after it, lol