Hacker News Reader

PHP itself is a memory safe language, this is a bug in the language implementation and VM. Which happens in other memory safe languages like Java or C#. This is sort of the equivalent of a Rust compiler bug that allows unsafe behavior to slip through, which also exist.

View on HN

No, PHP interpreter is written in C where such things happen every 100 lines of code. If PHP interpreter was written in Rust, this vulnerability wouldn't exist.

To be fair, C has simplicity as an attractive feature (compared to other languages) but being memory-unsafe is unacceptable, so we need either memory-safe C or stop using it.

Most interpreters or runtimes are written in unsafe languages. Including V8 (Chrome and Node), C#, and others. Also PHP is not really interpreted, it works just like C# or Java where it's compiled to bytecode that runs on a virtual machine.

Reply on news.ycombinator.com