Interesting chain of events that led us to today’s urgent php patching.

PHP, of course, stands for 'Patch Hastily: PHP'

Wonder if we will hear of another PHP RCE drop before the year is over lol

Wonder how out of control this stuff will get

It’s not like these widely used languages are corporate backed, they may receive donation but nobody is hiring security researchers to focus on PHP

Facebook uses its own version of PHP so it is likely not too concerned what happens to the original

Hard to say but there is a call for donations to the php foundation in the message. Yah php still has it uses, but doesn’t appear to be as wildly used for new projects. Albeit lots of old ones still use it alot.

I would say laravel is as popular as any other framework, it obviously includes JavaScript components also but I hear about it more than any singular full JavaScript framework (probably because there is so many)

Yah in my experiences, I see rust as the natural progression away from PHP…but now with all the llm craze, i bet languages get chosen by how easy an llm can code in it.

I think we will. This looks like a new class of vulnerability so there will be others of a similar nature.

Yah its interesting that the knew of it for about 2 years but couldn’t figure out how it would be exploited and sat on it for a while along with some miscommunication.

The 'S' in PHP stands for 'Secure'.

Good thing I don’t use that crap for anything… what happened anyway? I saw an email from digital ocean telling me to update stuff

Two year old bug that lead to a RCE under certain conditions was recently turned into an active exploit thanks to llms…or something along those lines.

That’s kinda what I figured lol wasn’t sure if some particular app was hacked or something

Haven’t heard much about anyone confirming a hack, but it did make it to the front page of the guardian today so…

Websites across world hit by millions of attempts to exploit PHP code flaw

Crazy how many exploits have been found and used in the past year. Shit is hitting the fan and ai has just barely arrived

Throw in some weak certs as well, i have a new found respect for the number 4 now lol