The Truth About PHP

[Vyn]

Oh so common:

[Zzzptm]

"We need to upgrade."
"Can't. Payroll won't run on the new version. Just ringfence it."

 

[Thelemech]

 

[Vyn]

Shortsighted biz decisions, man. Security through baling wire and spit just don't last.

[Zzzptm]

Shortsighted biz decisions, man. Security through baling wire and spit just don't last.

Don't even get me started on how bank trading floors are damn near untouchable in terms of doing security... most sensitive transactions are also the *fastest* transactions, so nobody wants to do nothing that will slow them down. NOTHING.

[Zzzptm]

https://www.theregister.com/security/2026/10/26/we-shouldnt-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue/5305186

The Register is my go-to for tech reporting.

Good news is that the PHP2Shell exploits have a complicated attack chain, so we're not seeing successful attacks yet. Bad news is Facebook is built on PHP and if it gets tanked, that wrecks an important segment of the AI circular funding arrangements. There's other bad news like how we can write patches quickly, but can't test them quickly enough to feel good about both beating the attackers to the punch and having the website work properly...

[Vyn]

There's other bad news like how we can write patches quickly, but can't test them quickly enough to feel good about both beating the attackers to the punch and having the website work properly...

Or introducing an even bigger hole that everyone jumps into seven hours after go-live.

Time is money, and a business exists to make the most money possible.

BUT, in this, our modern age, short-shrifting secops is not only poor decision making, it is criminal negligence as far as I am concerned.

[Zzzptm]

Same here, but those moneymen can hire some fancy lawyers with the corporate dollars to argue the other way.

Fun fact: websites hosted on MacOS back in the day were bulletproof. They ran no scripts, executed no code, had no x86 subsystems... just HTML and CSS all the way.