Before everyone decides this is all #PHP's fault and they should switch to some other backend... ALL SOFTWARE IS VULNERABLE and #GenAI is making this far worse.
Look for projects that are sticking with human code rather than deskilling for some meaningless LoC benchmark, and digging themselves into a hole that every user of their project is being pulled into.
@happyborg Yes, and. PHP has always been associated with security problems.
That doesn't mean that other languages/runtimes don't have problems, but PHP is famous for bad design. Like, really bad design.
Is that history relevant here? I don't know, because I haven't analysed the problem, but it really doesn't help perception-wise.
Oct 22, 2026, 1:41 PM@ahltorp @happyborg Not really. Most of PHP's old "insecure" reputation was badly coded amateur projects from 20 years ago. PHP attracted more self-taught newbies, so had more sloppy insecure code, than other languages.
This latest issue is in the PHP engine itself, which is battle-tested C code. As stated, it happens, but no more than other projects.
The optics are not great, yes, but the reality of the situation is very different.
@Crell @ahltorp Imagine if some AI slop created a similar vulnerability in the Linux kernel, making far far more systems running far more critical infrastructure vulnerable until it was revealed by some careless idiots before it could be fixed...
The thing that's least likely in that scenario is the last link in the chain.
The rest is IMO inevitable given #Linux adoption of deskilling mind eating #GenAI to build global critical infrastructure. Fingers crossed they're not as stupid as Calif.
@Crell @happyborg Sloppiness in one regard often correlates with sloppiness in another.
Perl, for example, has had taint mode for over 2 decades. If I look at PHP best practices *today* it tells me to please sanitise my inputs, no enforcement at all. It's a fundamentally different approach to security.
As I wrote, I haven't yet analysed the current problem myself, but from what I've seen from others' analyses, it seems that the patch is not great, and that the underlying design isn't either.