r/technology • u/barryshrug • 10h ago

Security ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/
3.9k Upvotes

98% Upvoted

240 comments sorted by

View all comments

Show parent comments

111

u/MakingItElsewhere 9h ago

Well, the alternative was to use Java, or .Net.

37

u/stray_r 8h ago

You could write cgi (common gateway interface) pages that PHP was designed to replace in C, C++ or Perl. All of these existed before PHP and early PHP implementations used the same CGI interface server side.

I've worked on cgi systems in C, PHP, Python, Java, Ruby and Haskell.

I'd recommend using the language specific web server modules where available as they leave much less room to introduce stupid site-level vulnerabilities.

I don't recommend using Haskell if you value your health or sanity.

Reddit was originally python and I was working on porting php a based social media platform to python at the time Reddit released the source code. That was an interesting scramble for my team to read a lot of code to see if there was anything we could plunder.

5

u/LieutenantNitwit 7h ago

I miss perl. Variable variables were so fun to abuse.

14

u/AndrewCoja 8h ago

Haskell should be illegal

11

u/Outrageous_Reach_695 8h ago

If someone says Haskell a third time, does it summon qn eldritch horror?

3

u/haskell_rules 4h ago

Monads are just monoids in the category of endofunctors

4

u/stray_r 7h ago

My thesis on Haskell data structures was an Eldrich horror

3

u/Pausbrak 5h ago

I actually think more programmers should play around with Haskell, precisely because it's so weird and out there. I spent a few weeks mucking about with it a decade ago and just that little exposure to pure functional programming gave me a lot of insight that I found very useful later on when map/reduce and similar operations became the next big thing in Java and C#.

I maintain it's too easy for software devs to get caught up in the same old patterns we're comfortable with if we just stick with the same old tools for everything. Learning as many different languages and programming styles as possible can really broaden our toolboxes even if we never actually use those languages for production.

Well, assuming people still have any interest in actually writing code, I guess. These days it seems like everyone just tells their AI agents to code everything so I guess it probably doesn't matter much anymore.

1

u/stray_r 4h ago

I understand your point, yes, programmers and computer scientists should explore different programming paradigms and I really like the lazy evaluation of Haskell.

However, Haskell is incredibly information dense and difficult to understand. I don't care how beautiful and elegant or even performant someone's 4 lines of Haskell are if it can't be easily read and understood.

I'd much rather have a page of python that is well understood by everyone who might need to work on it because easy to understand code generates less bugs when your most stupid team member does a quick modification under pressure.

And your most stupid team member is often future you dealing with a situation you didn't plan for whilst deprived of sleep and caffeine and under pressure to have finished an hour ago because time is money.

From my own bitter experience there is nothing worse than trying to read back in to a Haskell project, the cognitive load of understanding the incredibly dense code is really high compared to almost anything else that might be task appropriate.

2

u/Pausbrak 3h ago

I understand where you're coming from, and I'm not really trying to disagree with you. Not every language is good for production code, and as interesting as Haskell is intellectually I can imagine it's a pain in the ass to use for real software for exactly the reasons you mention.

I only wanted to share that I found learning it has been indirectly useful for me in getting better at programming with other languages. In general, I mostly make use of the skills I learned when I'm writing LINQ queries or Java Streams.

Funnily enough, I think getting more comfortable working with Haskell and similar functional approaches was exactly what has helped me get better at writing more readable and comprehensible LINQ queries. For instance, it's tempting to just stuff all the logic in a giant unreadable Select() lambda, but it's definitely easier on the eyes and brain when you chain a bunch of standard functions together instead.

1

u/stray_r 3h ago

I think Haskell gave me some very particular headaches. I was trying to figure out ways to deal with things the language doesn't do very well and mostly I discovered why that was.

Absolutely you should look at different perspectives and paradigms, but I think ultimately that code is read a lot more than it is written and the best code is not concise code or elegant code, it's easy to read, understand and maintain code.

And staying on today's topic, code that is secure by design is good code. A lot of my C probably wasn't and I'm so glad none of the CGI I worked on in C is still in the wild.

I don't actually know how vulnerable to attack Haskell projects are, it's so rare to use Haskell in anything web facing.

No. Don't go there Stray. Down this path lies madness. And Eldrich horrors.

1

u/lars_jeppesen 6h ago

CGI scripts were the devil. Horrible horrible

1

u/stray_r 3h ago

They were the only way to do interactive web at the time. Trying to do CGI in C or similar to get reasonably performance and serve a decent number of clients without falling over.

... I'm trying to think what I was even using back then... I think a 100Mhz Pentium Pro, can't remember how much ram it didn't have... And then a dual 400MHz Pentium 2 with 384Mb of ram, 5x 9Gb SCSI drives and an ILO bigger than a modern gaming graphics card...

Winning the argument for mod_php on apache because more hardware was cheaper than more developers and we could get more janky shit done faster with php than anything else at the time was a step forward. It was the future a quarter century ago.

And you have to remember that when bulletin boards like phpBB happened, they didn't distribute mods and upgrades as something you could apply with patch or a git pull, there was no git then. You had to hand patch phpBB, it was the stuff of nightmares but everyone wanted their own customised build of it.

I miss independent bulletin boards. I don't miss the maintenance.

1

u/TacoIncoming 1h ago

You could write cgi (common gateway interface) pages that PHP was designed to replace in C, C++ or Perl.

Because there’s no way that could go tits up 🤣

1

u/stray_r 57m ago

In the 90s there was much more opposition to scripting languages and much more do it in C because that's how we've always done it

The janky script for Personal Home Pages that runs a crazy amount of the web was a huge step forward.

I know what the onslaught of privative automated attacks on my servers did ~25 years ago. I dread to think what modern AI exploits would do to the janky C I was running in the 90s.

20

u/zezoza 9h ago

My whole company runs on 25 years of spaghetti JSP code

11

u/x_Trassic_x 9h ago

It'll take AI years to unravel that

7

u/peduxe 8h ago

Anthropic and OpenAI might just flag your account for suspicious activity trying to throw their models at a JSP codebase.

7

u/MakingItElsewhere 7h ago

"Why are the servers on fire?" "Someone asked them to look at their JSP, and they chose seppuku instead."

1

u/zezoza 6h ago

I'm kinda considering it... 

3

u/nrith 7h ago

Mine is XML files that I convert into the simplest imaginable HTML using XSLT. I figure it’s been working for 20 years, and is lightning fast because there’s no cookies or backend, and very little JS, so why change it?

1

u/zezoza 6h ago

I really envy your performance, not so sure if your stack though...

1

u/nrith 6h ago

Oh, I know my stack is horrible.

7

u/KagakuNinja 8h ago

Java JSP was equivalent to PHP. There was a bit more verbosity but nowhere near as bad as everyone seems to think. I once had to port some features from a PHP game to a Java game, and it was just a 1 for 1 translation to the JSP.

Java was built by professionals, with at least attempts at security and multi threading from day 1. PHP has been playing catchup for decades, it isn't at all surprising to see that a dumpster fire of a language is also insecure.

PHP was designed to be easy to get started, with pre configured LAMP distros. The extra ceremony of Java seems like a pain in the ass, until you suddenly need to do things like support multiple versions of the runtime, which is trivial with Java.

6

u/DoxxThis1 8h ago edited 1h ago

PHP wasn’t designed, it just evolved, like an brain-eating bacteria

0

u/npsimons 6h ago

PHP is the most ad hoc programming language, ever. Oh yeah, you'll hear its defenders say "such and such hasn't been an issue since X.Y.Z", but the fact is that all these problems are indicative of a deeper rot within the language itself.

We dumped bind because it was full of security holes, we dumped sendmail because it was full of security holes. Both of those were incredibly popular, yet the Internet managed to move on from them. PHP is just another legacy project that should stop being used.

You know all those vibecoders putting out massive steaming turds? It's the same mindset of PHP, "oh, it's easier, I don't have to learn anything!"

1

u/UnexpectedAnanas 26m ago

When something better comes along, the world will move on. Until then...

PHP, for better or worse, has secured its place on the web.

0

u/stray_r 4h ago

To do something quick and dirty, PHP. To actually maintain the codebase over time, anything else please, even Java.

2

u/fletku_mato 8h ago

Funny. I'd choose Java over PHP in a heartbeat.

1

u/EVILTHE_TURTLE 6h ago

Throw in some web objects and we’ll call it a deal!

1

u/Own_Reaction9442 3h ago

Before PHP, we used Perl to do CGI websites. Perl's syntax is based heavily on Perl's.

Before that it was a bunch of different stuff; TCL was fairly popular at one point.

0

u/cocotheape 8h ago

Or Flash, that was still extremely popular for websites when PHP was hot.