this post was submitted on 21 Oct 2026

205 points (98.6% liked)

Technology

89251 readers

4607 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

MODERATORS

L3s@lemmy.world

enu@lemmy.world

technopagan@lemmy.world

L4s@lemmy.world

L3s@hackingne.ws

205

PHP warns it plans to release 2 emergency patches imminently (arstechnica.com)

submitted 1 week ago by gedaliyah@lemmy.world to c/technology@lemmy.world

20 comments fedilink hide all child comments

all 21 comments

sorted by: hot top controversial new old

[–] unexposedhazard@discuss.tchncs.de 23 points 1 week ago* (last edited 1 week ago)

Hmm, yes i would hope so... So far nothing seems to be affected tho.

[–] nibbler@discuss.tchncs.de 15 points 1 week ago

https://github.com/syhunt/php2shell-protection

has some background and possible mitigations. But I shut down all my php sites...

[–] nastronot@lemmy.zip 9 points 1 week ago

Aw beans

[–] BetterDev@programming.dev 1 points 1 week ago

Nobody updates PHP lol

[+] orclev@lemmy.world -12 points 1 week ago (7 children)

It's wild to me that people are still using PHP in 2026. It was known to be a god awful trainwreck of a language all the way back in like 2005 and it certainly hasn't improved much since then. I guess that's what happens when a language peaks right at the height of the dotcom bubble.

[–] aniki@lemmy.zip 31 points 1 week ago (2 children)

You have no idea what you're talking about.

[–] EncryptKeeper@lemmy.world -1 points 1 week ago* (last edited 1 week ago) (1 children)

He’s right though. Didn’t know Lemmy was so pro PHP lol

[–] domi@lemmy.secnd.me 7 points 1 week ago

You don't have to be pro PHP to realize "PHP has not improved since 2005" is bullshit.

[+] orclev@lemmy.world -6 points 1 week ago (2 children)

I've been a professional programmer for over 30 years with some of the biggest companies in the world. I've worked with assembly, c, c++, c#, java, kotlin, perl, lua, haskell, rust, javascript, typescript, coffeescrpit, dart, php, python, and I'm sure 3 or 4 other languages I've just forgotten about at this point. Some of those languages are terrible and I hope never to touch again, others were great and I'd be happy to work with.

PHP should have been retired as a language 20 yeara ago, but WordPress has kept it alive all this time. The rest of the industry has moved on and learned lessons from what came before, but the sheer momentum of hundreds of thousands of WordPress installs has somehow kept PHP alive. The language started as a hack, and it remains a hack. It's gotten faster over the years, but it's still just as badly designed today as it was when it was originally created.

[–] non_burglar@lemmy.world 17 points 1 week ago

As a security auditor, I would have specified that it's the OLD php plugins/scripts extensibility that was the mess. And similar to CGI, PHP used to be a problem for infosec audits because it was usually so full of configuration holes that the mantra just became "Don't use PHP". AJAX implementations are also rife with security issues because of configuration errors. So is a default implementation of nginx.

But PHP gets the bad rep because it was hands down the most popular way to add custom functionality to a webapp during the time when infosec became a more widespread profession, a victim of its own success.

As an aside, a default install of PHP on reasonably modern Linux today is a hell of a lot more secure than it was in 2009. I know this because I did the comparison for a presentation to my peers in 2023.

This is the problem with extensible platforms that allow you the freedom to build what you want: their success is built on being malleable, which brings with it a lot of problems people with experience know to patch up, but less experienced people don't.

[–] phoenixz@lemmy.ca 17 points 1 week ago

When you have no idea what you are talking about, you post something like this

Its not 2005 anymore, not that PHP ever was a train wreck, but its not 2005 anymore. PHP has had a huge amount of improvements over the past two decades and I'll use it over anything else

[–] isVeryLoud@lemmy.ca 15 points 1 week ago

Symphony / Laravel is still super popular. I was gonna apply to a job posting at my partner's company, but I went "eh nvm" when I saw they were using Symphony 😭

[–] nastronot@lemmy.zip 9 points 1 week ago (1 children)

“It’s wild to me people are still using PHP”

You must be isolated from development if you think PHP is not still everywhere.

[–] Chozo@fedia.io 6 points 1 week ago (1 children)

That's not what he said.

[–] nastronot@lemmy.zip 1 points 1 week ago

That’s what she said?

[–] Quazatron@lemmy.world 8 points 1 week ago

I used it quite a bit right at the beginning, when it was transitioning from being a "Pre-HTML Processor" templating utility to a proper language.

The syntax was nice and easy to pick up. The rest was pretty bad, a lot of security was left to the developer following best practices.

It improved with time, but it had already left a bad impression on me.

I know it's still popular, as you can tell from the downvotes.

[–] AlecSadler@lemmy.dbzer0.com 6 points 1 week ago

A large percentage of sites use WordPress which uses PHP.

Outside of that, I've worked or consulted for 20-30+ companies across numerous industries and none of them used php or ever considered it.

[–] FiskFisk33@startrek.website 2 points 1 week ago (1 children)

it certainly hasn’t improved much since then.

I've heard the opposite talked about quite a bit.

https://www.youtube.com/watch?v=f5nGmE92zNA

[–] orclev@lemmy.world 3 points 1 week ago (1 children)

Of course it's Primeagen. I haven't watched this particular video, but I've seen enough of his videos to know he's an idiot. I wouldn't trust anything he says about programming, at least half of everything he says is wrong.

Most of the things wrong with PHP can't be fixed, at least not without completely breaking all the existing PHP apps in such a fundamental way it would be tough to argue it's still the same language.

[–] exu@feditown.com 6 points 1 week ago

Lol, they did break a lot of backwards compatibility going from 5.6 to 7. That's why years later you still had people holding out on the migration because it was such a huge change.