r/technology • u/Radio_TVGuy • 12h ago

Security New PHP vulnerability means the Internet will have a very rough couple of days

https://appleinsider.com/articles/26/10/21/new-php-vulnerability-means-the-internet-will-have-a-very-rough-couple-of-days
2.7k Upvotes

98% Upvoted

287 comments sorted by

View all comments

989

u/Single-Virus4935 12h ago

This will be way worse than log4shell, which is still a problem, as sooooooo many php servers are plain unmaintained and also php is used on maaany wrbinterfaces for devices like.routers, firewalls, IoT etc. which will never see an update ever. Log4shell was more enterprise and not that ubiquitous like php.

246

u/itzjackybro 12h ago

log4shell hit like every minecraft server when it came out

153

u/Single-Virus4935 12h ago

Yep, now imagine times a thousand.

There are firewall web interfaces coded with php and open to the internet. Like Juniper (v)srx, pfsense, fortinet etc.

Million websites, Next cloud instances, adservers, forums, .....

29

u/azsqueeze 11h ago

Wait next cloud runs on php? That seems like not a great choice of language for that kind of service

16

u/Accurate-Visual9793 8h ago

There has been a lot of effort put into making modern PHP not completely terrible. I still wouldn't choose it for a project, but it's not a complete liability anymore (other than well, these vulnerabilities)

2

u/AlleKeskitason 7h ago

I don't know much about what's baked into various programming languages, but wasn't php at least in the past considered a goddamn awful language by many? I just have this really vague memory of reading something about how the syntax or built-in functions were very extremely hacky or primitive or something, like they were designed by people who barely knew how to code.

11

u/itzjackybro 6h ago

PHP has syntax sugar that is specifically tailored towards web dev (like being able to embed directly into HTML, and something something builtin MySQL support?).

From what I remember, the LAMP (Linux/Apache/MySQL/PHP) stack was also huge back in the in the 2000's and early 2010's, and was like the recommended way to do simple websites at the time.

But I do agree, its syntax is about as horrid as it gets.

0

u/RellenD 6h ago

I thought lamp used Mongo

1

u/TaiGlobal 6h ago

Thats Mean/mean that uses mongo

1

u/RellenD 6h ago

Oh, mongo, Express, Angular, Node. You're right.

My brain failed at what feels like ancient history now

3

u/tommyk1210 4h ago

PHP 4.x and 5.x was awful. That what people mostly have memories of. But modern PHP 8.x is actually a decent language, especially with modern frameworks like symfony/laravel

2

u/gravteck 6h ago

Not a PHP guy but messed around with it 20 years ago, but it allows you to comingle presentation code with execution code. You could execute a python script on the server by just loading the page. If you know more about what's going on, and what data you could inject in the request, you have a potential exploit with remote code execution.

1

u/za72 4h ago

it enables coders to get themselves into trouble very easily... just like javascript... (watch all the js crew throw a fit ;) )

2

u/gravteck 4h ago

The repudiation performances put on by JS devs are something else. Just these deep nested mentions are like saying Beetlejuice, Beetlejuice, Beetlejuice.

1

u/za72 4h ago

npm sends it's regards!

1

u/nashbrownies 4h ago

My friend I mentioned this to about his various projects and he scoffed and said "What is this, the 1600's?"

1

u/azsqueeze 6h ago

I understand that but my statement wasn't really geared to the authering experience of the language

1

u/za72 4h ago

It really depends on the coder... it's as flexible as you want it to be... or as strict as you want it to be

frameworks allow it obfuscate things so that you only need to know php vs php+sql+whatever else you want to manipulate, even executing local OS tools... or roll your own Frankenstein code...