Hacker News Reader

Comment by LiveOverflow | Hacker News Reader

I didn't say it's "end of the world". I am just saying it's an insane vulnerability.

It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:

- Docker image `php:8.5.11-apache` is easy to exploit.

- Or the WordPress blog I installed with Digital Ocean template in 2023.

View on HN

> It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit.

But apache + mod_php hasn't been the default setup for a very long time, that's what people are trying to tell you. Given your expertise, you must know that already. So I have to conclude that you're arguing in bad faith because it's the only setup you can break.

I don't know this.

When I installed my WordPress blog with DigitalOcean template in 2023, it was Apache + mod_php.

Official WordPress docs mentions Apache before nginx: https://developer.wordpress.org/advanced-administration/serv...

Official php install instructions for Linux uses Apache + mod_php: https://www.php.net/manual/en/install.unix.debian.php

The first comment in that page literally says "the preferred method is now fastcgi" and links to PHP-FPM. This comment is 13 years old, and I personally haven't seen mod_php in the wild for a long time. PHP-FPM is also the default configuration in both Red Hat and Debian and in most operating systems derived from them.

Reply on news.ycombinator.com