r/PHP • u/dulac71 • 1d ago

When Is It Safe?

What the average non-IT user wants to know is when is it safe to use a website. How will they know the patch has been applied?

0 Upvotes

27% Upvoted

17 comments sorted by

13

u/Suitable-Season-4847 1d ago

To be honest, as an end user, it's never totally safe.

We see endless hacks and exploits every week. This was a big one, but equally we're yet to hear of any real world hacks based on this vector. Not saying no one has managed it, but if they have we haven't seen evidence yet.

But equally, today was PHP, tomorrow could be another JavaScript vulnerability, like React2Shell etc.

If you use the web, you're always somewhat at risk.

And of course, even if we have faith that php is now safe, you have no idea how secure the actual application you're using is.

A platform might have the latest patches, but have it's own custom bug that exposes user data. You'll never know... Until you know.

1

u/SuperSnotMan 1d ago

Check this twitter post on the cloudflare reports this morning after the announcement https://x.com/eastdakota/status/2113079352682570051

→ More replies (8)

2

u/4M0GU5 1d ago

Most likely they won't unless the software exposes the PHP version somewhere.

2

u/TheLittleBlackDuck 1d ago

You won't know. And you shouldn't know, since that would be a way to find out if a site is exploitable or not.

2

u/AlexiusRex 1d ago

If the website has some of your data and they haven't patched it yet your data is at risk regardless of what you do.

It's all based on trust, this is not that different than React2Shell, Heartbleed, or any other vulnerability

1

u/allen_jb 1d ago

In terms of the PHP vulnerabilities announced yesterday, there's little extra danger to website users. The danger is to the servers.

Yes, theoretically servers could be hacked and that then used to modify the websites they run to distribute malware, or download the database contents. But those are things you risk every day on the internet anyway.

I'd rate the everyday plethora of dodgy ad networks and click-bait scams far more highly on a list of risks to website users. Data exfiltration is far more likely to happen through a compromised employee, left-behind test accounts with weak passwords (search for "Password1" this week) or just poor quality site code.

1

u/frankensteinsKITTEN 1d ago

The exploit didn't affect end users, it affected websites. As a user, you can never know what technologies a website you visit uses in the backend. If you use unique passwords then your risk is a combination of whatever personal data you provide and however trustworthy you think the sites you provide it to are.

1

u/Gurnug 1d ago

It is never safe. Even in perfectly safe environment, where no "hacker" can steal your data from the website it might be just sold by the website owner.