Stephen Rees-Carter: “I find it painful sometimes, sitting in a security conferenc…”

Stephen Rees-Carter @valorin6d

I find it painful sometimes, sitting in a security conference where they talk about how insecure consumer devices and enterprise appliances are because of all the command-line RCEs on everything, and yet PHP is the insecure one? 🤦

06:10 · Oct 30, 2026commit 5b4fac2

Evan Edwards @EvanEdwards6d

I don't know if it is still standing, but about two days ago, the fellow who had a bitcoin in a webserver running unpatched PHP still had not been hacked. No reports of hacks have happened. I genuinely wonder if php2shell was a moral panic. Not the bugs and potential problem…

Matthew Peck-Deloughry @mdeloughry6d

I have always thought that too, I think PHP is destined to never lose its >5.xx reputation, or even to developers the misconception that PHP and WordPress are the same technology. I’m not saying Wordpress is bad but it was just(is) super popular and was easily misconfigured!

Commit