Slashdot Mirror

← Back to Stories (view on slashdot.org)

PHP 5.2.2 and 4.4.7 Released

Posted by CowboyNeal on from the hot-off-the-presses dept.

daeg writes "PHP 5.2.2 and 4.4.7 have been released with a plethora of security updates. Many of the security notifications come from the Month of PHP Bugs effort, and range from double freed memory to bugs in functions that allow attackers to enable register_globals, to memory corruption with unserialize(), to input validation flaws that allow e-mail header injections, with an unhealthy sprinkling of other bugs and flaws fixed. All administrators that run any version of PHP are encouraged to update immediately."

2 of 122 comments (clear)

  1. Tag this story "phpsucks" if you agree by Andrew+Tanenbaum · · Score: 0, Troll

    As the subject says, tag this story "phpsucks" if you agree. PHP is a notoriously insecure language, and its design philosophy from its "Personal Home Page" days still shines through, despite its later renaming.

  2. Re:I want to see someone claim again by nxtw · · Score: 0, Troll

    If you tried using Mono/C# in a real world situation you'd find that it would be horrible because it would run as a CGI. The initialization for it would kill the server.


    I don't think there's many high-perormance websites out there that work using forking (standard CGI). In fact, IIRC Mono doesn't even support working as CGI, and I'm pretty sure Java doesn't as well. They only support running via an external process server (much like Java), e.g. via FastCGI, local proxying, or a special webserver/process server interface. (I personally like this design much better than mod_php/mod_perl/mod_* or CGI for all but the most trivial of pages.)

    It makes security easier and it means that you don't have to use the Apache prefork process model (if you use Apache).