PHP has been fairly safe for the most part. We didn’t have a lot of those in the last 10 years.
The most notable one was in 2019 where PHP-FPM was vulnerable under nginx. Other than that, I can’t remember anything and I’m working with PHP for over a decade. There were some bugs that look very severe, but require access to the system first, making them relatively harmless.
I had much more emergency patchdays because of nodejs and that entire garbage ecosystem.
PHP has been fairly safe for the most part. We didn’t have a lot of those in the last 10 years.
The most notable one was in 2019 where PHP-FPM was vulnerable under nginx. Other than that, I can’t remember anything and I’m working with PHP for over a decade. There were some bugs that look very severe, but require access to the system first, making them relatively harmless.
I had much more emergency patchdays because of nodejs and that entire garbage ecosystem.