Php is a programming language from the 90s that is still popular today but is kinda the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.
It’s the backbone for a lot of other software, the Wordpress ecosystem most notably. Inertia is the big factor in terms of popularity.
Old school PHP was all about the LAMP stack (Linux as your operating system, apache as your web server, mysql as your database, php as the runtime apache would use to serve dynamic documents). The ecosystem was the real benefit that made it sensational for the era; all the pieces were designed to play nicely with one another.
It was also really noob friendly: You could write basic html, copy it to your web server, reload in browser, and see changes. Then to make things dynamic, you sprinkle in a few <?php?> tags in your html, copy it to the server, and it starts working! The code inside those php tags gets run by the web server and their output is written into the HTML. No reloading or resetting apache needed, and you need very little programming knowledge to start.
The modern language is… serviceable, but lost the key features that made it great.
That’s the problem with PHP. It’s quite easy to build something that works. It’s quite another to build something that works and is secure, scales well, is maintainable, etc. The thing is that ‘it works’ is something that people see immediately. Those other things they only get to experience when it’s too late.
This is compounded by the fact that because it’s so easy it attracts a lot of inexperienced developers who don’t even consider things like security. Add to that that the language is full of footguns.
That’s not to say it’s impossible to build good apps in PHP, but that is despite the language, not because of it. It takes experience, knowledge and discipline to write something secure and maintainable in PHP. Something a lot of PHP users don’t have.
Most of the main issue here where standard SQL practices were hugely insecure went by the wayside over a decade ago and the other issues are common to all internet work. PHP got to carry that heritage though.
But like, I’ve seen early work from a guy now making huge bucks with nvidia on their streaming side where I hacked it within minutes because he just didn’t know that you can’t do security with front end JavaScript.
Yea it does. Every language has bugs, every program has bugs. The measure of a language is not does it have bugs its how does the governing body respond to problems.
You could have the best language, fast to run, fast to build, uses low resources, but I’d the governing body responds to bug reports saying “well don’t do it then” or “user error” its adoption is not likely to happen.
The fact that I haven’t heard of any major webservice involuntary taken over so far makes me increasingly skeptical, though I can also attribute it to preemptive action, partially. I presume an exploit chain might come in concert with some other insecure configurations or some malware developed eventually, but it wouldn’t be the first CVE with inflated scores in recent years.
The patches were released yesterday, more than 24h ago. Originally they were supposed to be released today but some info leaked so they decided to step up the timetable.
Php is a programming language from the 90s that is still popular today but is kinda the punching bag to other languages. This week the people in charge of php said they are releasing emergency patches in a couple hours and take non critical systems offline until you have patched.
This has brought on a new round of bag punching.
Because as we all know, other computer languages never have had any vulnerabilities, ever
I haven’t heard of Rockstar having one. Go become a certified rockstar dev and confuse recruits.
Why’s it still popular?
It’s very fast to load in the browser and lightweight in the backend too, without sacrificing much functionality except for some fancy animations.
Personally I just hate the language syntax though 😅
It’s the English of programming languages. It’s a big ole cobbled-together mess that just happens to be useful in practice.
It’s the backbone for a lot of other software, the Wordpress ecosystem most notably. Inertia is the big factor in terms of popularity.
Old school PHP was all about the LAMP stack (Linux as your operating system, apache as your web server, mysql as your database, php as the runtime apache would use to serve dynamic documents). The ecosystem was the real benefit that made it sensational for the era; all the pieces were designed to play nicely with one another.
It was also really noob friendly: You could write basic html, copy it to your web server, reload in browser, and see changes. Then to make things dynamic, you sprinkle in a few
<?php ?>tags in your html, copy it to the server, and it starts working! The code inside those php tags gets run by the web server and their output is written into the HTML. No reloading or resetting apache needed, and you need very little programming knowledge to start.The modern language is… serviceable, but lost the key features that made it great.
I love LAMP.
I like your differentiated explanation most
Because it works. Why spend the money to rewrite something in another language when the current one is working fine?
angry Rust noises in the distance
Wait, you write web scripts in rust?
Lots of people write web sites in rust.
I don’t think it’s a great choice. But it does beat php.
That’s the problem with PHP. It’s quite easy to build something that works. It’s quite another to build something that works and is secure, scales well, is maintainable, etc. The thing is that ‘it works’ is something that people see immediately. Those other things they only get to experience when it’s too late.
This is compounded by the fact that because it’s so easy it attracts a lot of inexperienced developers who don’t even consider things like security. Add to that that the language is full of footguns.
That’s not to say it’s impossible to build good apps in PHP, but that is despite the language, not because of it. It takes experience, knowledge and discipline to write something secure and maintainable in PHP. Something a lot of PHP users don’t have.
Most of the main issue here where standard SQL practices were hugely insecure went by the wayside over a decade ago and the other issues are common to all internet work. PHP got to carry that heritage though.
But like, I’ve seen early work from a guy now making huge bucks with nvidia on their streaming side where I hacked it within minutes because he just didn’t know that you can’t do security with front end JavaScript.
As evident from this week troubles, no it doesn’t.
Yea it does. Every language has bugs, every program has bugs. The measure of a language is not does it have bugs its how does the governing body respond to problems.
You could have the best language, fast to run, fast to build, uses low resources, but I’d the governing body responds to bug reports saying “well don’t do it then” or “user error” its adoption is not likely to happen.
Not like php, no.
Installing it and creating a “Hello world” page is easy and from there the sunk cost fallacy kicks in
Yep. PHP stands for Perl Home Page. Perl is awful to debug and maintain.
One of these two statements are correct
I stand corrected:
P.S.: “One of these two statements *is correct.”
So close! In my defence, no posting before coffee is a good rule.
WordPress powers a huge percentage of all websites, and that’s written in PHP. MediaWiki is too, although that’s obviously a much smaller percentage.
Was a major vulnerability discovered?
Yep, two remote code execution rated at 9.2
https://www.php.net/archive/2026.php#2026-10-20-1
The ratings seem to be overblown, however. This is nowhere near some of the vulnerabilities people have compared it to, like heartbleed or log4shell
The leaked info incorrectly called it a 10 so people are acting like a 10. But an unauthenticated RCE is always a big issue.
It’s an unauthenticated RCE in very specific circumstances under particular configurations. We haven’t even seen functional exploits in the wild yet.
edit: more info (albeit from a single researcher) here: https://eliastaylor.com/noexploit/
The fact that I haven’t heard of any major webservice involuntary taken over so far makes me increasingly skeptical, though I can also attribute it to preemptive action, partially. I presume an exploit chain might come in concert with some other insecure configurations or some malware developed eventually, but it wouldn’t be the first CVE with inflated scores in recent years.
The default Apache configuration*
Two were, yeah.
wait, didn’t the patches finish?
The patches were released yesterday, more than 24h ago. Originally they were supposed to be released today but some info leaked so they decided to step up the timetable.
Yeah. You had me worried.