‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/Open linkView original on lemmy.zipSyndicated from the fediverse. Read and engage on the original instance.
View original on lemmy.ziphttps://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/Open linkView original on lemmy.zip
7 replies
Sounds like a reminder to (a) migrate off PHP wherever possible, and,
Keep your server processes sandboxed / running as a dedicated user.
And if you don't actually need dynamic rendering (looking at most WordPress installations), use a static site generator (Jekyll, Hugo, etc).
Low bar of entry compared to everything else back in the day. Also quite fast being written in C. Then Laravel came around and it exploded in popularity. And of course you have WordPress that back in the day allowed everyone to get a site up and running. Not just blogs, due to the vast amount of plugins. There are more, butI think those are the biggest reasons.
I seriously wonder how PHP got so popular. It has never been a paragon of ... anything from a serious engineer perspective.
Really because it was easier to deal with than Perl in the early days, and those were basically your choices.
Because it's easy. Just do some HTML markup and some CSS and slap some
<?phpinline. This is partially the same reason why there are so many horribly outdated versions "in production".And if not full static generation then a light dynamic option like Alpine.js
That wouldn't have helped much, because the vulnerability was in the server's handling of POST (I think specifically multipart) requests.