2 ms·

Took me a moment to understand they mean "shell scripting language for the web", as opposed to "webshell" as in remote command execution interface. https://en.

• phoe-krk 3y ago
  In surprisingly many cases, PHP is a web shell and a webshell at the same time.
  • gmuslera 3y ago
    It should not be very surprising considering the amount of vulnerability scans that have all internet exposed sites for several php applications and related patterns. It have the other kind of rot, if it was sitting there for long enough time without updates probably it is used by bad actors.
    • Retr0id 3y ago
      Nope. The incidence of vulns in freshly written vanilla PHP is higher than any other web-dev language I've seen. The reputation is deserved, and existed since before it stopped being a trendy language. Skilled PHP devs know to avoid the footguns, but that doesn't mean they aren't there.
      • gjsman-1000 3y ago
        Meh, JavaScript has a completely different footgun: Pulling in third-party dependencies for even basic tasks; hundreds of them for even a simple application. You've replaced the risks in the language itself, with increased risk of supply chain attacks.