alt Hacker News> It isn't a Log4J moment.
The difference is that PHP has a long history of vulnerabilities while platforms like Java don't. And as bad as Log4Shell was, it wasn't a problem with the core runtime. It wasn't even a problem with the most popular logging framework at the time.
I wouldn't downplay this.
Replies
Insimwytim • today at 12:56 AM
> It wasn't even a problem with the most popular logging framework at the time.
I can't say if it was most popular overall, but it (Log4Shell) was a nightmare for many F500 companies.
➕ show 2 replies
bawolff • today at 1:39 AM
I'd disagree. log4shell was a monster to patch and figure out what is and isn't vulnerable.
upgrading php is much easier.
➕ show 1 reply
Core run time vulnerabilities in PHP, the language and runtime itself, are rare. I remember the days when an exploit in the JVM was a daily announcement. To the point where they had to ban java applets from the web.