Today's PHP Security Release, and How We're Strengthening PHP Security
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/Open linkView original on timeyak.comSyndicated from the fediverse. Read and engage on the original instance.
View original on timeyak.comhttps://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/Open linkView original on timeyak.com
17 replies
The 'S' in PHP stands for 'Secure'.
PHP, of course, stands for 'Patch Hastily: PHP'
Wonder if we will hear of another PHP RCE drop before the year is over lol
I think we will. This looks like a new class of vulnerability so there will be others of a similar nature.
Yah its interesting that the knew of it for about 2 years but couldn’t figure out how it would be exploited and sat on it for a while along with some miscommunication.
Interesting chain of events that led us to today’s urgent php patching.
Good thing I don’t use that crap for anything… what happened anyway? I saw an email from digital ocean telling me to update stuff
Two year old bug that lead to a RCE under certain conditions was recently turned into an active exploit thanks to llms…or something along those lines.
That’s kinda what I figured lol wasn’t sure if some particular app was hacked or something
Haven’t heard much about anyone confirming a hack, but it did make it to the front page of the guardian today so…
Websites across world hit by millions of attempts to exploit PHP code flaw
Crazy how many exploits have been found and used in the past year. Shit is hitting the fan and ai has just barely arrived
Throw in some weak certs as well, i have a new found respect for the number 4 now lol
Wonder how out of control this stuff will get
It’s not like these widely used languages are corporate backed, they may receive donation but nobody is hiring security researchers to focus on PHP
Facebook uses its own version of PHP so it is likely not too concerned what happens to the original
Hard to say but there is a call for donations to the php foundation in the message. Yah php still has it uses, but doesn’t appear to be as wildly used for new projects. Albeit lots of old ones still use it alot.
I would say laravel is as popular as any other framework, it obviously includes JavaScript components also but I hear about it more than any singular full JavaScript framework (probably because there is so many)
Yah in my experiences, I see rust as the natural progression away from PHP…but now with all the llm craze, i bet languages get chosen by how easy an llm can code in it.