Eh, it's an RCE that's been around forever and runs on a pretty large number of websites. Worse a lot of businesses have things like wordpress sites so one of those getting compromised is a foot in the door allowing movement into the more protected areas of the network.

So yea, it's a big deal.

▲

SoftTalker 2 hours ago | parent [-]

Web servers should not be a foot in the door. They should be assumed hostile and stringently limited. PHP especially has been notorious for remotely exploitable bugs but that's probably more due to its popularity and wide use by beginners than it being strictly worse than any other stack in this regard.

	▲	pixl97 2 hours ago \| parent \| next [-]
		>Web servers should not be a foot in the door. shoobe < doobe PHP was a component in the LAMP stack which was known to be 'free' and easy to setup for new users at the time as you say. That builds an ecosystem. Ecosystems are very hard to move away from, especially when your users are not highly technical. Security is almost always a second or third rate consideration for this type of user. If you look at most applications configured in the enterprise, or practically any Microsoft web based application, they are not strongly security configured against write access to the machine.
	▲	trollbridge an hour ago \| parent \| prev [-]
		I treat my PHP servers like they're a hostile entity, going so far as to put them on their own VLANs, turning off optimisations for virtualisations to avoid container escaping, and so forth. It's a strategy that has so far paid off quite well. Thankfully in the era of AI it is gettig quite easy to refactor PHP into something else.