Hacker News new | ask | show | jobs
by Meekro 33 days ago
I've done PHP development for over 20 years, including some pretty large projects. I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked.

On the other hand, for my Linux servers, I had to do that twice in the last month with CopyFail and DirtyFrag.
1 comments
diek 33 days ago
CVE-2021-21703 [0] is a similar class of bug in the PHP interpreter itself that was pretty recent

https://www.sentinelone.com/vulnerability-database/cve-2021-...

link
ipaddr 33 days ago
This is not a PHP language interpreter bug this is a PHP FPM bug.
link
diek 33 days ago
That's a fair point, using 'interpreter' specifically was imprecise language on my part. My main point was php-fpm is developed by the core PHP team and is often the default in how PHP projects deploy these days, and that CVE was very similar to the recent 'fail' LPE vulnerabilities in the kernel.
link
ipaddr 32 days ago
php-mod is so fast these days
link