Top
Best
New

Posted by tuyuri 15 hours ago

PHP 8.2.35(github.com)
Related ongoing thread: Today's PHP security release, and how we're strengthening security - https://news.ycombinator.com/item?id=50182987
985 points | 535 commentspage 12
magar_fos 15 hours ago|
C'mon Ondřej..
lousken 14 hours ago|
it's out?
dizhn 12 hours ago||
yup
rvz 14 hours ago||
PHP is done.
rkozik1989 14 hours ago||
People have been saying this for the past 16 years, but the reality is once a system is in production over time it becomes increasingly risky to replace it. Because over the life of a piece of software you make tons of small fixes, resolve bugs, adding customer-specific functionality, etc. that you'd completely overlook when planning our requirements for a rewrite. Which is a big problem when other systems are dependent on the software operating a specific way i.e. APIs, web services, and so forth. Not to mention the economics of a rewrite also has to make sense. Nobody is going to spend 2-3 years recreating what they already had and get no additional functionality out of it. Certain software basically has to get so bad that literally anything replacing it is better than what came before for replacing it to be the right approach.
hn_submit 13 hours ago||
People shouldn't be using PHP. I was shocked some security focused websites are even using it. I just hope there's nothing of value on their servers and that it's not connected to their internal network in any way. In my experience this is almost always the case because it makes maintenance and development easier but effectively exposes your entire organization to the internet.

That 70% of the internet still uses it is shocking to me. These organizations deserve to get burned badly. Let this incident be a warning to all of them!

preg_match 11 hours ago|||
PHP is not a particularly insecure language. It’s certainly more secure than something like C or C++. Certain PHP applications are known to have vulnerabilities often, like WordPress.

PHP is a memory-safe language. This vulnerability is a memory safety bug in the VM, which does happen from time to time. It happens with V8 (JS), Java, C#.

Dezvous 8 hours ago|||
List a single language for web development that hasn't had a single RCE vulnerability
antiloper 14 hours ago|||
Just how debian was done after weak keys, OpenSSL was done after heartbleed, or Windows was done after (rolls dice) the print spooler RCE
AznHisoka 14 hours ago||
And how Crowdstrike was done after their fiasco 2 years ago...
chimeracoder 12 hours ago||
And Lenovo was done after Superfish
dizhn 12 hours ago||
Sony after installing a rootkit. (Although they really are dead to me now after paying two noise cancelling headphones of theirs)
SoftTalker 13 hours ago|||
Not at all. People will patch and carry on.
myko 14 hours ago||
always was
mrits 14 hours ago||
always will be
gslepak 14 hours ago||
If you're tired of having to upgrade Wordpress, point your agent at this tutorial:

https://blog.okturtles.org/2024/10/convert-wordpress-to-stat...

donohoe 14 hours ago|
…or just enable automatic updates.
toast0 14 hours ago|||
last I looked, automatic updates for wordpress meant letting the web server write to the document root, which may be on the same level of negligence as not updating quickly.

Plus, wordpress updating isn't going to help you upgrade php.

bombcar 14 hours ago|||
The problem with that is your site might get replaced by a rant by the CEO ...
bitbasher 13 hours ago||
So-- if PHP's sourcecode was unavailable (closed source), would this ever have been found? Probably not. Maybe it is safer to be closed source.
kstrauser 13 hours ago|
Know how recompilers are porting video games from one platform to another these days? That exact trick works just as well for finding vulnerabilities. Broadly.

1. Hey LLM, turn this binary into source code.

2. Hey LLM, see any glaring security issues with this source code?

bitbasher 13 hours ago|||
You can only do that if you have access to the binary. Which, in a web service, you shouldn't be able to access!
kstrauser 13 hours ago|||
But all the people deploying that binary to their webservers would have access to do that.
0x457 12 hours ago|||
So how is PHP being distributed in your funny world? Because I can tell you, even if you put it behind “register with your work email,” whoever seeks the binary will find it.
anonymous908213 11 hours ago|||
> Know how recompilers are porting video games from one platform to another these days?

They actually aren't. Most of the claimed cases of "recompilation" are just an emulator packaged into the same binary as the game so you can't tell it's an emulator, or are for projects that already had their source code available (in which case "porting" to WASM is trivial because all of the hard work is done by the people who write your-language-to-WASM compilers, and you just need to do a little bit of work to adjust your toolchain to use it). Everyone just takes slopshit at face value and shares clickbait without actually checking any of the work done. It's infuriating how empowering this software is for liars, honestly.

amelius 11 hours ago||
Can't we fingerprint the code in github and elsewhere and tell AI labs to not do security reviews on the code unless (A) someone is a legitimate security researcher or (B) someone is the owner of the code.

Yeah it sucks, but the alternative could be worse.

small_model 14 hours ago|
Does anyone use PHP anymore? I assumed it was abandonware
CookieCrisp 14 hours ago||
No, the entire world abandoned it when you realized it wasn't the perfect language. The rest of us are just role playing today basically. It's a bit of a lark, kind of like civil war reenactment.
hurfdurf 14 hours ago||
"Four diffs and seven lines ago..."
jorisw 14 hours ago|||
Are you fucking serious?

Ever heard of WordPress?

AdamGibbins 14 hours ago|||
or Wikipedia.
small_model 14 hours ago|||
Is WordPress still a thing? Why hasn't it been rewritten in Rust by Claude?
openclawuser 14 hours ago||
I see the downvotes and I don't really disagree with you.

This hurts because my resume has laravel and WordPress on it. I built sooo many sites/apps on it.

With AI agents, I just can't imagine using PHP anymore unless I'm patching legacy stuff.

I loved laravel too... WordPress, love hate.