Hacker News Reader

I'm very skeptical having been in this business for decades. It's almost common knowledge that any PHP site can be hacked by intelligence agencies or state actors due to either errors in the runtime or the solutions themselves.

This incident got a lot of publicity, but what about the thousands of plugins out there full of hacks and sloppy programming?

View on HN

Again, there are virtually no vulnerabilities in the runtime itself. PHP has had less vulnerabilities than V8.

Certain applications, like Wordpress, are notorious for vulnerabilities. But these happen at the application level. PHP, as a language, is memory safe and largely secure.

Think of it this way. V8 has had numerous RCE vulnerabilities in the runtime. But also, react router has had RCE vulnerabilities. But react router was due to poor application design, much like Wordpress, where actors could trigger arbitrary code on the backend from manipulating requests. That’s very similar to how most wordpresss vulnerabilities work.

Reply on news.ycombinator.com