Interesting chain of events that led us to today’s urgent php patching.

The 'S' in PHP stands for 'Secure'.

Wonder how out of control this stuff will get

It’s not like these widely used languages are corporate backed, they may receive donation but nobody is hiring security researchers to focus on PHP

Facebook uses its own version of PHP so it is likely not too concerned what happens to the original

PHP, of course, stands for 'Patch Hastily: PHP'

Wow, fuck Chainguard.

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.

No honor amongst profiteers.

We need to rebuild tech infrastructure in a way that doesn't count on the benevolence of guys that will sell the entire world out for a quick buck.

It’s just for making a Personal Home Page, so not a big deal either way, right?

Delete PHP and it will be the most secure scripting language on the planet.

There wasn't much reason to use PHP before, and there's none now. Even existing PHP projects can easily be ported to a faster and more secure language.