3 ms·

There's clear evidence that php, both the language and popular libraries, have a much worse security history compared to other language even after weighting the

There's clear evidence that php, both the language and popular libraries, have a much worse security history compared to other language even after weighting the level and number of vulnerabilities against language popularity and amount of code. https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id=74 https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_i... https://www.cvedetails.com/top-50-products.php?year=0 https://www.cvedetails.com/top-50-products.php?year=0

aruggirello 9y ago
I don't know. It seems the number of issues in each of those products more or less reflects their size. The fact that PHP comes with a huge builtin function list thanks to bundled extensions is IMHO penalizing it. It would be interesting to match the number of issues in each product with the number of SLOC - possibly excluding comments - I'm sure we'd have a more level playground (assuming they're all mostly C/C++).
- tyingq 9y ago
  Things like WordPress, with millions of installs, also make it a popular target.