5 ms·

PHP Core Security Audit Results

137 points by moebrowne 2y ago

avkpatel 1y ago
This is good for php community.
sgc 1y ago
Mainly I want to say thank you. An incredible amount of work and dedication has gone into php over a very long period of time. The php community has managed to reinvent php several times, mainly just to make the language better. May they continue with their great success.
- kyriakos 1y ago
  It's also important to understand how all these are achieved with so little ($683k donated in 2024) Considering how much php code is out there the budget php foundation has at its disposal is very small. I wished more companies sponsored.
  - elashri 1y ago
    I was under the impression that facebook would be more interested into PHP health since I thought they relied on it more. But it seems that my impression was outdated by a decade.
    - mhlakhani 1y ago
      They moved to Hack many years ago, at some point the languages diverged too much
Ayesh 1y ago
Huge shout-out to the PHP Foundation for this. Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Some of the recent initiatives from the Foundation (https://thephp.foundation/blog/2025/03/31/transparency-and-impact-report-2024/ https://thephp.foundation/blog/2025/03/31/transparency-and-i...) : - All PHP versions now receive a total of 4 years of security updates; 2 bug fixes + 2 security, up from 3. - PIE: A replacement for PECL, to easily install PHP extensions (C, C++ compiled, not PHP packages). - The security audit. (I'm one of the PHP Core team and a volunteer at the foundation, happy to answer any questions, but almost all of the work is public)
- zakki 1y ago
  >>> Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor? Source: https://opencollective.com/phpfoundation/contribute/major-sponsors-34207 https://opencollective.com/phpfoundation/contribute/major-sp...
  - system2 1y ago
    Why does Laravel have a dude with a Hawaiian shirt, though? Heh
    - some_developer 1y ago
      It's the creator of Laravel, Taylor Otwell
      - avkpatel 1y ago
        People are calling him savior of PHP. :D
        wiseowise 1y ago
        Is it true, though? Serious question, I don’t participate much in PHP topics.
        WildGreenLeave 1y ago
        I'm a heavy PHP & Laravel developer and I speak for myself and a few close friends around my in my network who are like me. We all consider Laravel the reason we are still within the PHP scene and didn't move away. So in a sense I think it is true. That said, the recent changes around Laravel (being bought out and becoming more and more commercial) is not something I (we) consider a good thing. Not necessarily a bad thing, but we all know that a OSS framework becoming commercial doesn't usually end well.
chris_wot 1y ago
I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?
- p4bl0 1y ago
  It's cheap, it's fast, it's simple, and it works everywhere.
- dukeofharen 1y ago
  The language has its quirks, but frameworks like Laravel make application / API development very easy. And, of course, it runs practically anywhere :)
- sidkshatriya 1y ago
  TL;DR Your dad's PHP is no longer the current PHP. The language itself has been thoroughly modernized, made more consistent, bug free and performant. There is nothing better than a piece of software that keeps getting improved decade after decade borne out of real developer needs and experience. - Type annotations are integrated and work well with PHP now. This results in a kind of scripty Java OOP that is more succinct and type checked ! (it is possible to write PHP without types when you want metaprogramming features also) - Many inconsistencies in the design of the language (OOP, function naming etc.) have been resolved/smoothed out - The language recognises the inherent problems with `null` and allows you to make type annotations that rule out null. This is my smell test for a language BTW -- golang for instance does not seem to have a good story for null. - PHP Language developers have been really good about increasing performance year after year - Lots of software like web frameworks and CMSes continue to be based on PHP And -- the greatest part of the design -- PHP remains the best example of the "shared nothing" architecture. An architecture that allows you to scale your application easily.
  - graemep 1y ago
    > Your dad's PHP is no longer the current PHP. I am pretty much in the "your dad" category here. Where best to start learning how PHP has changed since I used it? There are things that appeal to be about PHP.
deleted 1y ago
[deleted]

137 points by moebrowne 2y ago

This is good for php community.

sgc 1y ago

Mainly I want to say thank you. An incredible amount of work and dedication has gone into php over a very long period of time. The php community has managed to reinvent php several times, mainly just to make the language better. May they continue with their great success.

kyriakos 1y ago
It's also important to understand how all these are achieved with so little ($683k donated in 2024) Considering how much php code is out there the budget php foundation has at its disposal is very small. I wished more companies sponsored.
- elashri 1y ago
  I was under the impression that facebook would be more interested into PHP health since I thought they relied on it more. But it seems that my impression was outdated by a decade.
  - mhlakhani 1y ago
    They moved to Hack many years ago, at some point the languages diverged too much

Ayesh 1y ago

Huge shout-out to the PHP Foundation for this. Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Some of the recent initiatives from the Foundation (https://thephp.foundation/blog/2025/03/31/transparency-and-impact-report-2024/ https://thephp.foundation/blog/2025/03/31/transparency-and-i...) : - All PHP versions now receive a total of 4 years of security updates; 2 bug fixes + 2 security, up from 3. - PIE: A replacement for PECL, to easily install PHP extensions (C, C++ compiled, not PHP packages). - The security audit. (I'm one of the PHP Core team and a volunteer at the foundation, happy to answer any questions, but almost all of the work is public)

zakki 1y ago
>>> Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor? Source: https://opencollective.com/phpfoundation/contribute/major-sponsors-34207 https://opencollective.com/phpfoundation/contribute/major-sp...
- system2 1y ago
  Why does Laravel have a dude with a Hawaiian shirt, though? Heh
  - some_developer 1y ago
    It's the creator of Laravel, Taylor Otwell
    - avkpatel 1y ago
      People are calling him savior of PHP. :D
      - wiseowise 1y ago
        Is it true, though? Serious question, I don’t participate much in PHP topics.
        WildGreenLeave 1y ago
        I'm a heavy PHP & Laravel developer and I speak for myself and a few close friends around my in my network who are like me. We all consider Laravel the reason we are still within the PHP scene and didn't move away. So in a sense I think it is true. That said, the recent changes around Laravel (being bought out and becoming more and more commercial) is not something I (we) consider a good thing. Not necessarily a bad thing, but we all know that a OSS framework becoming commercial doesn't usually end well.

chris_wot 1y ago

I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?

p4bl0 1y ago
It's cheap, it's fast, it's simple, and it works everywhere.
dukeofharen 1y ago
The language has its quirks, but frameworks like Laravel make application / API development very easy. And, of course, it runs practically anywhere :)
sidkshatriya 1y ago
TL;DR Your dad's PHP is no longer the current PHP. The language itself has been thoroughly modernized, made more consistent, bug free and performant. There is nothing better than a piece of software that keeps getting improved decade after decade borne out of real developer needs and experience. - Type annotations are integrated and work well with PHP now. This results in a kind of scripty Java OOP that is more succinct and type checked ! (it is possible to write PHP without types when you want metaprogramming features also) - Many inconsistencies in the design of the language (OOP, function naming etc.) have been resolved/smoothed out - The language recognises the inherent problems with `null` and allows you to make type annotations that rule out null. This is my smell test for a language BTW -- golang for instance does not seem to have a good story for null. - PHP Language developers have been really good about increasing performance year after year - Lots of software like web frameworks and CMSes continue to be based on PHP And -- the greatest part of the design -- PHP remains the best example of the "shared nothing" architecture. An architecture that allows you to scale your application easily.
- graemep 1y ago
  > Your dad's PHP is no longer the current PHP. I am pretty much in the "your dad" category here. Where best to start learning how PHP has changed since I used it? There are things that appeal to be about PHP.

deleted 1y ago

[deleted]