r/technology • u/low-skills • 10h ago
Software Multiple websites could go dark as critical PHP flaws spark global cyber alert
https://insiderpaper.com/critical-php-flaws-websites-down/239
u/This-Requirement6918 10h ago
I'm so glad I got out of web development when I did. Absolutely impossible to keep up with it these days.
136
u/Hyldenchampion 10h ago
I'm getting out of computers :D Carpentry and living alone in a cabin can't be hacked yet.
66
u/gizamo 10h ago
Those were hacked millennia ago by the invention of fire.
30
13
u/letharus 9h ago
That and the big bad wolf
1
u/PM_ME_FIREFLY_QUOTES 7h ago
So, brick, and were home free?
2
4
3
19
1
88
u/metalbox69 10h ago
Lucky my sites run on WordPress /s
31
u/ayayadae 10h ago
my company's website literally is on wordpress. i have NO idea why :') we are a large professional organization with like five thousand employees. i am baffled by the choice every single day
59
u/gizamo 9h ago
About 30% of Fortune 500s use WordPress.
WordPress is perfectly fine when managed properly.
People who pretend it's a bad platform are usually pretty ignorant of web development in general.
I say this as an guy who's always preferred headless C# with Angular, Vue, or Svelte frontends. Rust is also cool.
2
u/ayayadae 9h ago
i am ignorant of web development, i work in a creative department at my company xD but have a little memory fragment somewhere in my brain from 20 years ago of someone telling me wordpress is bad, and i guess it's stuck with me! i do work with that team a lot and the whole process to update anything seems like a mess but perhaps it's because it's just not managed properly
24
u/gizamo 9h ago
Yeah, WordPress got that reputation because it makes site building somewhat accessible to non-devs, and then those non-devs use an insane amount of plugins that they never update. They also never update the core framework, and especially not the PHP and mySQL stack they're running on because that's much harder. That's what causes 99.9% of the vulnerabilities. But, of course, they're non-devs, so they have to make a big ruckus about their failures while blaming the platform instead of owning their own mistakes.
Similarly, when someone builds a custom site, it often has vulnerabilities that go undetected simply because it's custom. But, that also usually makes it less of a target for hackers. After all, why hack one custom site when you can attack a platform with millions of outdated mom blogs?
4
2
u/metalbox69 9h ago
As gizamo said it's fine and, if manage well, can outperform many expensive enterprise CMSs. However it's low barrier to entry is also a curse, with people bloating there sites with plugins and poor code.
4
u/Cheese_Grater101 9h ago
Why bother using a fancy framework to rebuild your company website if the current wordpress implementation is fine?
It's ecosystem is mature despite the shitty ass subscription plan plaguing every plugins.
10
35
u/Underscores_Are_Kool 9h ago
Is this due to AI finding vulnerabilities and if so, can we expect a lot more going forward?
40
u/leupboat420smkeit 8h ago
From what I have read, yes this was discovered back in August in conjunction with OpenAI under their "Patch the Planet" program. I have no idea why they would sit on this for as long as they did.
29
u/ii_Narwhal 8h ago
I imagine they sat on it while a patch was being developed.
-19
u/leupboat420smkeit 8h ago
I don’t think it took 2 months development time to patch this
32
u/No_Hell_Below_Us 8h ago
“The patching effort was massive. There are close to 200 files being fixed and developers wrote over 10,000 lines of code during the process.”
6
u/starliight- 3h ago
The quote is so comedically opposite and immediately disproves that comment I genuinely laughed
-18
u/JELLYHATERZ 7h ago
So one ai prompt?
12
u/SeaworthinessThat594 7h ago
Can't fathom people writing actual code? Or is your understanding of AI so shallow that you think typing a prompt magically fixes 200 files and 10,000 lines of code? Must be nice being this confidently clueless.
4
u/npsnicholas 4h ago
That's an easy prompt. "Fix these files. Make no mistakes. Don't become skynet."
3
u/EconomyDoctor3287 6h ago
The thing is, the way the exploit works and how PHP handled errors, just fixing the proven exploits wouldn't solve anything, because there are a lot of vulnerabilities very similar, so the PHP team had to work overtime to change how errors are handled, etc.
2
u/Designer-Rub4819 7h ago
Even worse in 2024!
1
u/Living_Beyond_6613 3m ago
Right, a security audit brought the bugs to light. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/#a-first-external-audit-and-increased-security-focus
9
4
13
u/weirdoaish 9h ago
I'm shocked something like this hasn't happened to JavaScript yet. What even are the odds 😆
25
u/e37d93eeb23335dc 8h ago
JavaScript is the only programming language that runs in browsers. So huge tech companies like Google are constantly working on improving it and hardening it and making it faster. I’d guess that more resources have been thrown at JavaSceipt than any other language ever. Perhaps all other languages combined. Theoretically, this should make JavaScript have fewer vulnerabilities.
5
u/nuttertools 7h ago
It happens multiple times each month. V8 is the poster-child for the
10 days since an accident meme.
4
u/DrRonSimmons 9h ago
Why do people on here hate PHP so much?
23
u/ramh 9h ago
mostly, childish reasons, it was an introduction language for many, so there's a lot of unmantained or poorly made code, the language is fine, it's fast, is quick to setup, it serves its purpose well, that's why it's so popular in the first place.
11
u/DrRonSimmons 8h ago
Yeah, it was an honest question, but got a lot of downvotes for some reason, which kinda validates your point. I used it a lot back when I was a web developer 20 years ago, but haven't been in that field for years so I was wondering if I missed something.
11
1
u/OrphisFlo 3h ago
Redditors don't like the uncomfortable truth. They mistake the messenger with the one who caused it.
1
u/forksporkspoon 7h ago
It's valuable in it's place. It keeps getting shoved into places it doesn't belong.
-66
u/LessWerewolf 10h ago
Why do I feel that we could see a new headline sometime soon about how Anthropic or Open AI came through with fixing this and saving the internet 🤔
9
48
u/trentluv 10h ago
Because you don't understand what a backdoor is and how they're addressed but this is fine. Reddit always makes shit sound more antagonizing - not my intention
-5
6
u/MrThickDick2023 9h ago
It's because you didn't read the article and see in the second paragraph that patches are already scheduled to be released for these vulnerabilities.
4
u/Noble1xCarter 9h ago
That's because they use AI to spoon-feed them everything instead of actually reading the source
-68
u/Sonofa-Milkman 10h ago
Do all those website makers rely on php at all? I think its all css configs with html only nowadays, isnt it?
19
u/Accurate_Koala_4698 10h ago
Tons of wordpress sites still in production. I think Facebook is still PHP, no?
14
u/The__Toast 10h ago
Facebook runs Hack, which is Meta's own language that was built from PHP but is now a distinct entity.
22
u/xondk 10h ago
PHP runs most of the web...
'css with html' is just the user facing side of it, the server, the machine that gives you this css and html, is what runs php.
-12
u/NikEy 9h ago
I mean not really. Let's be really honest here. If you take out WordPress and Facebook, then it's absolutely a fringe language nowadays. It's like COBOL. It just happens to have a larger footprint due to first mover's advantage but in reality nobody who would design a new site nowadays would use PHP ever again.
6
8
u/xondk 9h ago
According to w3techs
https://w3techs.com/technologies/overview/programming_language
PHP is still nearly 70% of the web, That would not be a fringe language.
"If you take out"
Yes, but if you can anything out of the whole, you are not getting a perspective on the whole.
1
u/wackOverflow 3h ago
Well they are right in that nobody is spinning up new projects with PHP. That number will only get smaller every year. Also, that graph only reflects the server-side language that they know, so the real number could be less.
1
u/xondk 3h ago
Well they are right in that nobody is spinning up new projects with PHP.
Are they? people have been saying this forever about PHP or that it is dead/dying, yet it still stands, yeah there is more diversity and that is great, I believe strongly in people should use what makes sense for their project, and yes, it is less likely to be PHP now a days, it is much more likely to be javascript or python.
But I do not think it is going anywhere as such.
24
u/Strong_Internet_3726 10h ago
PHP is everywhere, even in places people don't know about. There are sysadmins analyzing their stack right now looking for anything that uses PHP and finding it when they didn't even know it was there.
21
5
6
0
u/sharantir 10h ago
Yup it well known that css can fetch data from the backend. And what about the html programming language. Oh my! Cutting edge.
-13
u/Fine_League311 8h ago
Dont make panic on the Titanic! Only upgrade your to PHP to 8.5.12 or PHP 8.4.27 or PHP 8.3.36 or PHP 8.2.35 (Support-End at 31. Dezember 2026. Than no problem if your sites pour coded, than good night 😁
112
u/CondescendingShitbag 9h ago
Well, this is going to make my day fun. I picked the wrong week to stop sniffing glue.