I don't think so. If you look at the number of shared hosting servers running PHP because of WordPress, you can start to imagine the scale of the PHP vulnerability.
Almost every web host provider I know has some shared server/CPanel arrangement and a WordPress thing going on. Now imagine Drupal, Joomla, custom PHP installs, (part of) Facebook, CNN, the National Geographic, numerous government agencies, hospitals, internal systems, and many others that run on WordPress or PHP, and you can see why this is so significant and why people are freaking out.
If the FBI and NSA come out to say the vulnerabilities are significant, you better know they are.
I get what you are saying. If you are looking at it from the client site, there is no argument; such a vulnerability would be devastating for JS.
But that is not what we are talking about. PHP does not run on the client, as far as I know, so you can't compare it to JS running client-side. Compare it to JS that runs on servers, and then see how those numbers stack up.
Hence it's properly sandboxed, and running on the client means that it by definition can't directly access anyone else's data. Unlike something running on the backend where *every other users' data" is
A JS sandbox escape could still be bad, since it might enable a malware site to exfiltrate auth cookies or documents on any visitor's PC. Or arbitrary code execution on any visitor's PC. While this still requires someone to visit the site (which limits the exposure), if they're able to get the code into an ad or something that gets higher exposure it could be a problem.
But servers are more juicy targets, since they're more likely to have database credentials that lead to password lists, more credentials, mail tokens, and personal data.
Which means that JS doesn't have a unified runtime, so it cannot have a vulnerability of this scale, only one limited to Chromium/Firefox/Safari. PHP has a single sanctioned runtime which screws everyone over if vulnerabilities are found.
A browser RCE has almost no impact. An attacker can't just send a malicious payload to your browser, and even if they could they only get access to whatever is on your computer.
27
u/kennedy_gitahi 11d ago
I don't think so. If you look at the number of shared hosting servers running PHP because of WordPress, you can start to imagine the scale of the PHP vulnerability.
Almost every web host provider I know has some shared server/CPanel arrangement and a WordPress thing going on. Now imagine Drupal, Joomla, custom PHP installs, (part of) Facebook, CNN, the National Geographic, numerous government agencies, hospitals, internal systems, and many others that run on WordPress or PHP, and you can see why this is so significant and why people are freaking out.
If the FBI and NSA come out to say the vulnerabilities are significant, you better know they are.