PHP Vulnerabilities Announced

Simone Klassen writes "The Hardened-PHP Project has announced several serious and according to them, easy-to-exploit vulnerabilities within PHP. A flaw within the function unserialize() is rated as very critical for millions of PHP servers, because it is exposed to remote attackers through lots of very popular webapplications. The list includes forum software like phpBB2, WBB2, Invision Board and vBulletin. It is time to upgrade now."

No comment?

[jardin]

They must be all busy upgrading :)

Kewl

[mordors9]

I can't wait for someone to release a script that I can use to show what a leet haxor I am.

I've said it before, and I'll say it again

[Neil Blender]

PHP: 10 million newbies can't be wrong.

Re:I've said it before, and I'll say it again

[snoyberg]

You're absolutely correct! I'll go convert all my scripts to ASP and avoid all of PHP's security holes by running on Microsoft software.

Re:I've said it before, and I'll say it again

[cosinezero]

But scripting languages are what applications are made of! Right?

Re:I've said it before, and I'll say it again

[Anonymous Coward]

I assume you dislike PHP. What would you recommend instead?

A language that is a little more practical for extracting and reporting.

NB

Re:I've said it before, and I'll say it again

[flatface]

mod_bf [sourceforge.net]

Re:No comment?

[stevesliva]

No, all the sysadmins are on holiday vacation. Come on folks, announcing security vulnerabilities on a Friday in December? That's just plain mean.

Re:Kewl

[Anonymous Coward]

They already have, you've just got to figure out how to exploit it using the announcement.

Why are these things always announced on Friday?

[kd3bj]

Why can't it be Monday? I mean, do the people that make these announcements think we _like_ working weekends?

If

[Alioth]

If PGP stands for Pretty Good Privacy, does PHP stand for Pretty Hopeless Privacy?

Re:This proves once an for all

[fitten]

# in a perfect world this would increse my karma
$karma++;

No... that would be "in a Perlfect world..."

Re:I've said it before, and I'll say it again

[Anonymous Coward]

Umm...by using Microsoft software you would avoid all of PHP's security holes.

Re:I've said it before, and I'll say it again

[Anonymous Coward]

A language that is a little more practical for extracting and reporting.

Ahh.. python.. a great choice!

pwn3d

[Anonymous Coward]

PHP sux0rs
ASP r0x0rs.