Slashdot Mirror
As PHP Group Patches High-Risk Bugs, 62% of Sites Still Use PHP 5 (threatpost.com)
America's Multi-State Information Sharing & Analysis Center is operated in collaboration with its Department of Homeland Security's Office of Cybersecurity and Communications -- and they've got some bad news.
MS-ISAC released an advisory warning government agencies, businesses, and home users of multiple high-risk security issues in PHP that can allow attackers to execute arbitrary code. Furthermore, if the PHP vulnerabilities are not successfully exploited, attackers could still induce a denial-of-service condition rendering the probed servers unusable... The PHP Group has issued fixes in the PHP 7.1.23 and 7.2.11 releases for all the high-risk bugs that could lead to DoS and arbitrary code execution in all vulnerable PHP 7.1 and 7.2 versions before these latest updates.
But meanwhile, Threatpost reported this week that 62% of the world's web sites are still running PHP version 5 -- even though its end of life is December 31st. "The deadlines will not be extended, and it is critical that PHP-based websites are upgraded to ensure that security support is provided," warned a recent CERT notice.
So far Drupal is the only CMS posting an official notice requiring upgrades to PHP 7 (by March, three months after the PHP 5.6's end of life deadline). Threatpost notes that "There has been no such notice from WordPress or Joomla."
But meanwhile, Threatpost reported this week that 62% of the world's web sites are still running PHP version 5 -- even though its end of life is December 31st. "The deadlines will not be extended, and it is critical that PHP-based websites are upgraded to ensure that security support is provided," warned a recent CERT notice.
So far Drupal is the only CMS posting an official notice requiring upgrades to PHP 7 (by March, three months after the PHP 5.6's end of life deadline). Threatpost notes that "There has been no such notice from WordPress or Joomla."
It will never escape itself.
Just to make it look like you know anything at all about programming and PHP.
Was version 6 utterly shite, or can't they even count?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
certainly a lot of improvements since I started using it 15 years ago. still waiting at work for the IT guys to let us get off 5.3.x :(
Wait... PHP, the language? You seem to be talking about something else.
If these are against PHP7, why the need o call out people still running PHP5??
Take your forced deprecation and shove it, please. There was a trend in IT to avoid exotic languages for exactly this reason, think it's time we went back to that. Maybe a little less time writting node "applications" and "frameworks".
PHP 5 renamed to PHP XP, and all bugs become features.
They got the problem of the maintenance that is very expensive.
How about you don't release utterly broken software in the first place?
Yes, I know "everyone" does it too. Same goes for them, obviously.
This feature seeks to provide better security when unserializing objects on untrusted data. It prevents possible code injections by enabling the developer to whitelist classes that can be unserialized.
My coder sense is tingling.
The new intdiv() function performs an integer division of its operands and returns it.
The fuck?
To enable strict mode, a single declare directive must be placed at the top of the file. This means that the strictness of typing for scalars is configured on a per-file basis.
session_start() now accepts an array of options that override the session configuration directives normally set in php.ini.
Global and/or server variables that change how the language behaves. Check.
It still looks like a clusterfuck to me, although maybe slightly more unfucked than the last one.
Thank you
Please complain more about why names don't will work with anonymous posts.
Command deprecated.
Syntax deprecated.
Function deprecated..
Upgrade and your shit's all fucked up. Of course people don't upgrade. Nothing nicer than having a PHP upgrade bring down a few hundred WordPress sites.
Lots of enterprises rely on RHEL 7 / CentOS 7, and those are currently shipping PHP 5.4.16.
#DeleteChrome
Besides, normally even numbers are used for stable releases. Why would PHP ever be considered dependable or trustworthy as a stable runtime?
Everyone is making it sound like PHP 5.6 is some ancient piece of cruft that everyone has had PLENTY of time to upgrade. In fact, after looking it up, it's only about four years old. That surprised me. It's at end of life already?
Since when is "move fast and break things" a winning strategy for a server-side scripting language which runs much of the world's internet infrastructure? Shouldn't the "deadline will not be extended" attitude perhaps be re-evaluated in light of reality?
We've seen this happen before, of course. Language developers often seem to underestimate how long it takes infrastructure to migrate to newer, incompatible versions of a language. For instance, the Python 2.7/3.x split, which occurred a *decade* ago, is still causing headaches on occasion. At least the Python devs had the good sense to support 2.7 until 2020. I'm going to bet that another four years from now, you'll still see a significant number of sites still using PHP 5.6, official support or not.
Irony: Agile development has too much intertia to be abandoned now.
The reason everyone uses 5.5 is that Symfony2 requires it. bits of Symfony2 are in fucking everything.
Php/jquery frameworks are some of the worst Webdev shit that exists. We should go back and start developing things with C rather than creating these god damn framework shits.
PHP devs should stop incrementing their version.
Why they can't call it 'php'?
I had to edit multiple directories to upgrade PHP5.x to 7.0, and I will have to do so again if I want to upgrade to 7.1/7.2.
Stop doing this and give me ESR edition.
Oh I dunno, maybe the fact that most things in the world of the web is built on it, and that the majority of these things operate perfectly fine - that which does not is a problem of the web application, not PHP. Don't conflate poor applications with poor languages/frameworks. They are complex tools and misuse isn't the fault of the language. It has quirks, but it's not incapable. Only a non-programmer - or finicky developers with "special needs" - will tell you so.
Replacing stuff from 5.x that doesn't work is nigh trivial. Then again, if you did your homework and didn't code crap, 5.x is perfectly safe.
Of course we all know that PHP is the favorite PL of many people who can't programm, so YMMV.
We suffer more in our imagination than in reality. - Seneca
From a scan of the change log looks like all the attack vectors require a maliciously written script to run on the server I didnâ(TM)t see anything remotely exploitable why didnâ(TM)t they mention scope? I am Ignoring devs who might pass web input to eval they have other problems already.
There is a *lot* of code out there that does questionable stuff in PHP. Stuff that approximately works in PHP 5.6 but fails hard in PHP 7. A large amount of it is relying on things that were deprecated way before PHP 5.6 was even considered as a possibility. A lot of that code is non-trivial so it isn't a quick fix to update it, or worse, is orphaned and there is nobody to update it.
Even worse, a large fraction of it is on sites who don't have a programmer. It exists in unmaintained modules or add-ons to some framework or other that is, itself, often never upgraded. At $dayjob, I've lost count of the number of web sites that get defaced because someone bought a web site from $random_web_developer who used $framework and then never did any maintenance. I mean, people still expect a web site to be "fire and forget", especially if it's a simple brochure style site, and don't understand why they should have to put resources into maintaining it. And they're not wrong, either. These are the vast majority of the sites I can't force-upgrade to PHP 7 without having the customers simply cancel their accounts and not pay their outstanding bills. (Eventually I'll have to, but not today.)
On the other hand, I had almost no issues running PHP code I wrote on PHP 7. But that's probably because I don't overcomplicated the code with eleventy thousand classes, namespaces, autoloading classes, "Composer", or any other fancy gimmick that is all the rage today. The issues I did have tended to be due to code that really shouldn't have worked in the first place, or actually wasn't working properly even on PHP 5.6.
If it works in theory, try something else in practice.
Your application may well work with PHP 7.x, or there may be a newer version of it that does work with the newer version. That is unless you have home grown code, or must run an older version.
If you are running Debian or Ubuntu, you can upgrade PHP to 7.2, using the following commands:
This works on Ubuntu 16.04 LTS, if you need to stay on that, and not having to upgrade to 18.04 LTS. The former is supported for a few more years.
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
a publicly exposed language which has always had security issues,
clever websites - not
Go well
I try your hosts file and my computer explode. Now I annoying.
It still looks like a clusterfuck to me, although maybe slightly more unfucked than the last one.
Regrettably $CLUSTER_FUCK is a superglobal.
Joomla has been urging people to update to PHP 7 for quite awhile now. There's a big message right on the admin dashboard.
APK
GO the fuck AWAY!
(everybody...!)
APK
GO the fuck AWAY!
APK
GO the fuck AWAY!
APK
GO the fuck AWAY!
APK
GO the fuck AWAY!
It might be, but the major reason for people not upgrading is that there are breaking changes between the major versions of php.
So you can't just drop in a new version because then something on your server breaks. And anyone that knows that piece of code has long ago left for greener pastures. It's usually some medium sized package that just do the job and is key for the business.
Php is also a headache from a test perspective since you don't find the broken stuff until you try to access it. Some of it may only be accessed once per year and only during new year break by an automatic script.
Things like that makes me dislike script based solutions.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Successfully exploiting the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the affected application.
This phrase was reworded almost a dozen times to make up an article. The end result making it sound like if you run PHP then you are vulnerable. But if you look at the bugs they are just standard bugs.It's like how the drug commercials almost always list death as a possible side effect. That doesn't mean if you take any drugs you'll die. You might, but it doesn't mean that.
APK doesn't understand security which is why he thinks a non cryptographically secure self check is valid, all his does is check it's current running size over and over again. Hosts only stops sources that are known, long after they have become a threat, and never before. APK's work is slow and can be fooled easily and does not provide any security beyond a placebo effect. APK also doesn't understand how the OS caches host lookups or caches in general work because if he did he would stop spouting off about it being cached. But we all already knew that APK suffers from debilitating mental illness.
Yes, php, a language that built sql injection vulnerabilities into the API.
Since a lot of existing code depends on 5, why not fork 5 and fix the security problems rather than try to convert it all to 7?
We aren't talking about Star Trek here.
It should be noted that CentOS 6 notably (and RH6 I would assume) by default still ship with PHP 5 (5.6 by now I think?) To get a newer version, you must add a different repo as I don't think PHP7+ is even in EPEL. I can easily see why the number is so high, not to mention anyone crazy enough to run PHP on IIS where it most likely will just tick to the end of its useful life instead of going through an upgrade process.
I think a large percentage of that is the CentOS/RHEL that is still on 5.x which isn't as awful as it sounds because Redhat will ensure security fixes for 5.x as long as they continue to distribute it. They have a history of backporting fixes to ensure stable versions for a very long time. But I am very surprised by how long they've stayed at PHP 5.x, feels like more focus was placed on python 3 than php 7, and for good reason.
See subject: He BOTH hosts + RECOMMENDS it -> forum.hosts-file.net/viewtopic.php?f=5&t=4290
My code's also VIRUS PROOF (self-checking mathematically down to 1 byte change) upmodded @ CODING FOR DEFCON on /. in 2005 as a good method http://it.slashdot.org/comment...
I won't give my work away so "OpenSORES" thieves can use it (or abuse it, see EFast/Google Chrome).
APK
P.S.=> Dozens of REGISTERED /. users (+ 100,000 users worldwide) disagree with you https://it.slashdot.org/commen...
Hosts results STOPPING MALWARE = UNDENIABLE https://science.slashdot.org/c...
SECURITY PROS agree hosts work https://it.slashdot.org/commen... for MORE speed AND security & they do so NATIVELY for less (resources consumed, less moving parts for exploit vs. SECURITY ISSUE RIDDLED DNS/AntiVirus (which slow you down vs. local hosts in RAM cached) ... apk
See subject: his FAKEname on a post impersonating me https://linux.slashdot.org/com... & altering /.er's words.
c6gunner tried to mock me 1st https://linux.slashdot.org/com...
So I challenge c6gunner to show he did better work than mine & he CAN'T!
YOU DEMAND PROOF of others here?
"I've yet to see you provide any evidence of that." by c6gunner on Monday March 15, 2010 @10:02PM (#31490942) ?
So now I DEMAND IT OF YOU & YOU FAIL!
c6gunner = "Run, Forrest: RUN!!!
* c6gunner's LYING saying I did a MacOS X one - I haven't yet & c6gunner's LYING impersonating me saying hosts work vs. Intel CPU issues (spectre/meltdown).
APK
P.S.=> You say hosts = shit here https://slashdot.org/comments.... ?
FACTS: /.ers & security pros + RESULTS say DIFFERENT:
1st: /.ers https://slashdot.org/comments.... https://slashdot.org/comments.... https://slashdot.org/comments.... https://slashdot.org/comments.... https://slashdot.org/comments.... https://slashdot.org/comments....
2nd: SECURITY PROS https://slashdot.org/comments....
3rd: REAL RESULTS w/ hosts vs. threats https://slashdot.org/comments....
EAT YOUR WORDS!
This ThreatPost article blatantly copies a ZDNet story: https://www.zdnet.com/article/around-62-of-all-internet-sites-will-run-an-unsupported-php-version-in-10-weeks/
Just saying. If you're gonna run this story, at least run the actual reporting, and not some lame clone that doesn't even give credit to the actual source. I'm getting tired of these Indian and Pakistani blogs claiming to be news outlets these days.
Look everyone we either have someone who is more retarded than APK or APK trying to make it look like he has support. If you aren't APK why do you stick up for a worthless pile of shit who can't even defend his own work from criticism? You sure sound a lot like APK so are you his live in butt buddy?
Look everyone. It's the unidentifiable anonymous coward who runs and hides from questions put to him like he runs and hides from apk who he stalks.
There are tools to check your code to see if it will work with newer versions of PHP, like PHPCompatibility.
Any testing PHP is easy : you can write unit tests, integration tests, etc.
Blocking sources of threats = how you STOP THEM & they're STILL THREATS you dumb fuck. You think your line of bs = effective from you? Guess again stupid.
It doesn't check over & over. It checks itself when any procedure or function runs & against size change (which is what virus' do altering function jmp tables attaching to end of a program on disk).
It works great.
YOU TRYING TO SAY THAT A KNOWN BAD SITE LIKE THIS E.G.:
0.0.0.0 thissitefucksupyoursystem.com
IS NOT BLOCKED BY THAT(when accessed by that host/domain name in a browser OR otherwise IF that entry is in hosts)?
* YOU ARE VERY WRONG (& you KNOW it) IF YOU THINK THAT (but nobody said you have the ability to think, let alone logically or critically).
APK
P.S.=> Lastly - nobody believes you UNIDENTIFIABLE anonymous NOBODY do-NOTHING mere "ne'er-do-well" - lol, EVEN YOU DON'T BELIEVE YOU - you don't STAND BEHIND YOUR WORDS (all lies & deceits) constantly STALKING ME... apk
The problem is still that you have to get someone that can care for the code. It's a common problem - hire someone to do a specific job and then when that person leaves there's just something that works, but it happens to block upgrades also for other applications.
Just come out to the reality and see - the world is full of small solutions that happens to be blocking upgrades of larger application suites. And the management of the companies don't want to upgrade "because it works" and that they don't want to spend money on "unnecessary upgrades", sometimes so that they can raise the share values or get a new car.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Oh believe me, I know ;-)
Managers don't understand that any piece of software needs maintenance...
I thought FB used HipHopVM (HHVM), a p-code/JIT implementation of PHP.
While the PHP 5->7 parade is a serious problem, this weird MS-ISAC advisory appears to be bogus. Most likely ineptitude. You know what they say about ineptitude and malice.
Here's a public note from Ubuntu's maintainer about it.
https://bugs.launchpad.net/ubuntu/+source/php7.2/+bug/1798625
How did this get all over the news without so much as a CVE attached to it? It certainly seems like a fake news hack job.