People have been saying this for the past 16 years, but the reality is once a system is in production over time it becomes increasingly risky to replace it. Because over the life of a piece of software you make tons of small fixes, resolve bugs, adding customer-specific functionality, etc. that you'd completely overlook when planning our requirements for a rewrite. Which is a big problem when other systems are dependent on the software operating a specific way i.e. APIs, web services, and so forth. Not to mention the economics of a rewrite also has to make sense. Nobody is going to spend 2-3 years recreating what they already had and get no additional functionality out of it. Certain software basically has to get so bad that literally anything replacing it is better than what came before for replacing it to be the right approach.
replyPeople shouldn't be using PHP. I was shocked some security focused websites are even using it. I just hope there's nothing of value on their servers and that it's not connected to their internal network in any way. In my experience this is almost always the case because it makes maintenance and development easier but effectively exposes your entire organization to the internet.
replyThat 70% of the internet still uses it is shocking to me. These organizations deserve to get burned badly. Let this incident be a warning to all of them!
PHP is not a particularly insecure language. It’s certainly more secure than something like C or C++. Certain PHP applications are known to have vulnerabilities often, like WordPress.
replyPHP is a memory-safe language. This vulnerability is a memory safety bug in the VM, which does happen from time to time. It happens with V8 (JS), Java, C#.
List a single language for web development that hasn't had a single RCE vulnerability
replyJust how debian was done after weak keys, OpenSSL was done after heartbleed, or Windows was done after (rolls dice) the print spooler RCE
replyAnd how Crowdstrike was done after their fiasco 2 years ago...
replyAnd Lenovo was done after Superfish
replySony after installing a rootkit. (Although they really are dead to me now after paying two noise cancelling headphones of theirs)
replyNot at all. People will patch and carry on.
reply