PHP is not a particularly insecure language. It’s certainly more secure than something like C or C++. Certain PHP applications are known to have vulnerabilities often, like WordPress.

PHP is a memory-safe language. This vulnerability is a memory safety bug in the VM, which does happen from time to time. It happens with V8 (JS), Java, C#.

▲

hn_submit 11 hours ago | parent [-]

To me PHP has an aura of "unprofessionalism" around it. Many of the PHP solutions have been hacked together by amateurs who sought a solution for their own problem and by chance it became widely used.

The language itself was one big hack when it was created. It has improved somewhat but just like with C++ you can still use the C syntax that's at the core of it all.

This isn't the last we'll hear of PHP vulnerabilities because the exploits exist on multiple levels. Not just the language (runtime) but the solutions using it too.

	▲	preg_match 4 hours ago \| parent [-]
		I mean you’re just incorrect about the C++ vs C comparison here. PHP is a memory safe language, just as memory safe as Java, C# and JS. The runtime itself has very few vulnerabilities and bugs, and is quite mature. There’s no “drop down into C” type thing in PHP, where you can just write unsafe code whenever you want. The closest thing is extensions, which operate on the runtime itself. In the past 10 years, the PHP runtime has had little to no exploitable vulnerabilities. The V8 runtime has had much more. Mostly because their implementation is much more complex. The PHP language was hacky in the very early days, but for over a decade now it’s been mature and professional. It’s basically just dotnet.