PHP cyber security

[xoggoth]

Has anyone seen this?

Websites taken down worldwide as critical PHP cyber-security update issued - BBC News

Darn it, my business website runs on a rather old version of PHP, so unlikely it will still work if I update to the latest version.

Seem to be a few PHP code checkers available on line, anyone tried them? Which is best?

 

[xoggoth]

Hmmm. Used this one with version 8.5 selected and came up with no errors.

PHP Syntax Checker - No Upload Required

 

[cojak]

Apparently it was discovered in 2024 and deemed too complex to exploit.

Oh ye of little faith…

 

[WooHooNomad]

Don't know much about PHP but OpenAI have released a couple of skills for Codex to check websites.

https://github.com/openai/php2shell-checker. (from this blog https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/)

 

[xoggoth]

Cheers WooHooNomad. I'll have a go, trouble is I always find Github pretty incomprehensible.

 

[xoggoth]

Phew! Updated to latest PHP version and all seems ok. Only problem I had was with the captcha security thing for sending messages but found an updated version online.

 

[WooHooNomad]

Phew! Updated to latest PHP version and all seems ok. Only problem I had was with the captcha security thing for sending messages but found an updated version online.

Nice one, pretty serious exploit from what I've read.

 

[WhoApprovedThis]

When over 70% of the Internet seems to have had been taken offline (check external sources sky news) the kidz think rust, nodejs runs the Internet, then check again.

Underlying systems that keep Internet going are good old dns, networking, apache, php

Whereas nodejs has vulnerabilities almost daily with many packages pawned upstream, api keys stolen etc etc but hey tech is cool for tech demos and agile deliverables - just children playing in a sandpit compared to websites that run the Internet.