People have been saying this for the past 16 years, but the reality is once a system is in production over time it becomes increasingly risky to replace it. Because over the life of a piece of software you make tons of small fixes, resolve bugs, adding customer-specific functionality, etc. that you'd completely overlook when planning our requirements for a rewrite. Which is a big problem when other systems are dependent on the software operating a specific way i.e. APIs, web services, and so forth. Not to mention the economics of a rewrite also has to make sense. Nobody is going to spend 2-3 years recreating what they already had and get no additional functionality out of it. Certain software basically has to get so bad that literally anything replacing it is better than what came before for replacing it to be the right approach.
People shouldn't be using PHP. I was shocked some security focused websites are even using it. I just hope there's nothing of value on their servers and that it's not connected to their internal network in any way. In my experience this is almost always the case because it makes maintenance and development easier but effectively exposes your entire organization to the internet.
That 70% of the internet still uses it is shocking to me. These organizations deserve to get burned badly. Let this incident be a warning to all of them!
PHP is not a particularly insecure language. It’s certainly more secure than something like C or C++. Certain PHP applications are known to have vulnerabilities often, like WordPress.
PHP is a memory-safe language. This vulnerability is a memory safety bug in the VM, which does happen from time to time. It happens with V8 (JS), Java, C#.
To me PHP has an aura of "unprofessionalism" around it. Many of the PHP solutions have been hacked together by amateurs who sought a solution for their own problem and by chance it became widely used.
The language itself was one big hack when it was created. It has improved somewhat but just like with C++ you can still use the C syntax that's at the core of it all.
This isn't the last we'll hear of PHP vulnerabilities because the exploits exist on multiple levels. Not just the language (runtime) but the solutions using it too.
I mean you’re just incorrect about the C++ vs C comparison here.
PHP is a memory safe language, just as memory safe as Java, C# and JS. The runtime itself has very few vulnerabilities and bugs, and is quite mature. There’s no “drop down into C” type thing in PHP, where you can just write unsafe code whenever you want. The closest thing is extensions, which operate on the runtime itself.
In the past 10 years, the PHP runtime has had little to no exploitable vulnerabilities. The V8 runtime has had much more. Mostly because their implementation is much more complex.
The PHP language was hacky in the very early days, but for over a decade now it’s been mature and professional. It’s basically just dotnet.
I'm very skeptical having been in this business for decades. It's almost common knowledge that any PHP site can be hacked by intelligence agencies or state actors due to either errors in the runtime or the solutions themselves.
This incident got a lot of publicity, but what about the thousands of plugins out there full of hacks and sloppy programming?
Again, there are virtually no vulnerabilities in the runtime itself. PHP has had less vulnerabilities than V8.
Certain applications, like Wordpress, are notorious for vulnerabilities. But these happen at the application level. PHP, as a language, is memory safe and largely secure.
Think of it this way. V8 has had numerous RCE vulnerabilities in the runtime. But also, react router has had RCE vulnerabilities. But react router was due to poor application design, much like Wordpress, where actors could trigger arbitrary code on the backend from manipulating requests. That’s very similar to how most wordpresss vulnerabilities work.
People have been saying this for the past 16 years, but the reality is once a system is in production over time it becomes increasingly risky to replace it. Because over the life of a piece of software you make tons of small fixes, resolve bugs, adding customer-specific functionality, etc. that you'd completely overlook when planning our requirements for a rewrite. Which is a big problem when other systems are dependent on the software operating a specific way i.e. APIs, web services, and so forth. Not to mention the economics of a rewrite also has to make sense. Nobody is going to spend 2-3 years recreating what they already had and get no additional functionality out of it. Certain software basically has to get so bad that literally anything replacing it is better than what came before for replacing it to be the right approach.
People shouldn't be using PHP. I was shocked some security focused websites are even using it. I just hope there's nothing of value on their servers and that it's not connected to their internal network in any way. In my experience this is almost always the case because it makes maintenance and development easier but effectively exposes your entire organization to the internet.
That 70% of the internet still uses it is shocking to me. These organizations deserve to get burned badly. Let this incident be a warning to all of them!
PHP is not a particularly insecure language. It’s certainly more secure than something like C or C++. Certain PHP applications are known to have vulnerabilities often, like WordPress.
PHP is a memory-safe language. This vulnerability is a memory safety bug in the VM, which does happen from time to time. It happens with V8 (JS), Java, C#.
To me PHP has an aura of "unprofessionalism" around it. Many of the PHP solutions have been hacked together by amateurs who sought a solution for their own problem and by chance it became widely used.
The language itself was one big hack when it was created. It has improved somewhat but just like with C++ you can still use the C syntax that's at the core of it all.
This isn't the last we'll hear of PHP vulnerabilities because the exploits exist on multiple levels. Not just the language (runtime) but the solutions using it too.
I mean you’re just incorrect about the C++ vs C comparison here.
PHP is a memory safe language, just as memory safe as Java, C# and JS. The runtime itself has very few vulnerabilities and bugs, and is quite mature. There’s no “drop down into C” type thing in PHP, where you can just write unsafe code whenever you want. The closest thing is extensions, which operate on the runtime itself.
In the past 10 years, the PHP runtime has had little to no exploitable vulnerabilities. The V8 runtime has had much more. Mostly because their implementation is much more complex.
The PHP language was hacky in the very early days, but for over a decade now it’s been mature and professional. It’s basically just dotnet.
I'm very skeptical having been in this business for decades. It's almost common knowledge that any PHP site can be hacked by intelligence agencies or state actors due to either errors in the runtime or the solutions themselves.
This incident got a lot of publicity, but what about the thousands of plugins out there full of hacks and sloppy programming?
Again, there are virtually no vulnerabilities in the runtime itself. PHP has had less vulnerabilities than V8.
Certain applications, like Wordpress, are notorious for vulnerabilities. But these happen at the application level. PHP, as a language, is memory safe and largely secure.
Think of it this way. V8 has had numerous RCE vulnerabilities in the runtime. But also, react router has had RCE vulnerabilities. But react router was due to poor application design, much like Wordpress, where actors could trigger arbitrary code on the backend from manipulating requests. That’s very similar to how most wordpresss vulnerabilities work.
List a single language for web development that hasn't had a single RCE vulnerability
C# (ASP.NET) and Java.
Java has had plenty. Remember when everyone in security flinched when they heard the words "java.io.Serializable"?
Just how debian was done after weak keys, OpenSSL was done after heartbleed, or Windows was done after (rolls dice) the print spooler RCE
And how Crowdstrike was done after their fiasco 2 years ago...
And Lenovo was done after Superfish
Sony after installing a rootkit. (Although they really are dead to me now after paying two noise cancelling headphones of theirs)
Not at all. People will patch and carry on.
always was
always will be