PHP2Shell is a warning shot for vulnerability disclosure

The technical details of web server stacks are worth learning about. Preferably not from the TV news. Last week, knowing about PHP was a niche professional interest. This week, cab drivers have opinions.

PHP is not the story; it's the illustration. There are good reasons that it has this most unfortunate of spotlights. It's very old, and it shows. Growing from roots in the mid-1990s, it has never suffered from the straitjacket of a specification, and while it has seen a lot of refactoring and modernization, it retains design elements from more than 20 years ago.

PHP is emphatically not the only project where urgent demands for better performance, reliability, and features consume the resources needed to tidy up ugly internals that appear to work just fine. Until, one day, that technical debt falls due. There will be many more days like this.

PHP's significance is that it isn't unique. The details don't matter that much, although this annotated comic …