3 ms·
To clarify, when we say outdated PHP 5.3, we only mean the standalone PHP version. When an ubuntu version was detected, it was correctly marked as maintained. S
by dolfje 11y ago
To clarify, when we say outdated PHP 5.3, we only mean the standalone PHP version. When an ubuntu version was detected, it was correctly marked as maintained. So all these hosters use 5.3 without package managers.
- kijin 11y agoThat sounds much better. Please clarify it in the article so as not to spread FUD. It would also be helpful to release a table of the exact versions you found, instead of merely linking to their websites. Those who are still running PHP 5.2 deserve to be shamed even more!
- deleted 11y ago[deleted]
- dspillett 11y agoHow are you scanning to detect the OS version though? And verifying if PHP came from a package or a separate compile? Some hosts deliberately fuzz external indications of the base OS so you'd need an account to log into to properly check this, and they could have a compile from source version of PHP due to install procedures that date back before major updates to the base OS (and were updated "the wrong way"). Your effort is laudable (I'm all for naming and shaming the insecure) but you are open to false positives which could cause you legal issues.
- dolfje 11y agoBy using multiple versions of multiple software, you can determine the false positives. There are little servers that deliberately fuzz external in a consistent way of all software found. Mostly they only do PHP or Apache, but forget OpenSSH. If there is a hoster doing it in consistent way and ended on our shame list. Please stand up, you deserve a full new blog post about how it should be done.