Comment

Comment on ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

pageflight@piefed.social ⁨9⁩ ⁨hours⁩ ago

Sounds like a reminder to (a) migrate off PHP wherever possible, and,

“The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory,” Wiz writes in its research. “That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.”

Keep your server processes sandboxed / running as a dedicated user.

And if you don’t actually need dynamic rendering (looking at most WordPress installations), use a static site generator (Jekyll, Hugo, etc).

source

Sort:hotnew top

spankysalmon@fedinsfw.app ⁨7⁩ ⁨hours⁩ ago
I seriously wonder how PHP got so popular. It has never been a paragon of … anything from a serious engineer perspective.

source
- rabidhamster@lemmy.dbzer0.com ⁨7⁩ ⁨hours⁩ ago
  Really because it was easier to deal with than Perl in the early days, and those were basically your choices.
  
  source
- kungen@feddit.nu ⁨7⁩ ⁨hours⁩ ago
  Because it’s easy. Just do some HTML markup and some CSS and slap some <?php inline. This is partially the same reason why there are so many horribly outdated versions “in production”.
  
  source
mushroommunk@lemmy.today ⁨8⁩ ⁨hours⁩ ago
And if not full static generation then a light dynamic option like Alpine.js

source
- Ghoelian@piefed.social ⁨7⁩ ⁨hours⁩ ago
  That wouldn’t have helped much, because the vulnerability was in the server’s handling of POST (I think specifically multipart) requests.
  
  source