‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire

Comments

• pageflight@piefed.social ⁨59⁩ ⁨minutes⁩ ago

  Sounds like a reminder to (a) migrate off PHP wherever possible, and,

  “The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory,” Wiz writes in its research. “That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.”

  Keep your server processes sandboxed / running as a dedicated user.

  And if you don’t actually need dynamic rendering (looking at most WordPress installations), use a static site generator (Jekyll, Hugo, etc).

  source

  • mushroommunk@lemmy.today ⁨32⁩ ⁨minutes⁩ ago

    And if not full static generation then a light dynamic option like Alpine.js

    source
• MeetMeAtTheMovies@hexbear.net ⁨2⁩ ⁨hours⁩ ago

  What ridiculous percentage of the internet runs on Wordpress still? Maybe it’s less now that AI floods everything with everything. But you gotta know so many of those sites are not updating any time soon

  source

  • mushroommunk@lemmy.today ⁨30⁩ ⁨minutes⁩ ago

    Supposedly 40% of all websites as of 2025 use it in some form w3techs.com/technologies/details/cm-wordpress

    source