In July 2004, security researcher Stefan Esser sent a warning.
A critical flaw in PHP, the programming language that powers 70% of the world’s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites.
But Esser’s warning went mostly ignored for decades. In 2020, another researcher discovered a related problem, and the PHP overseers issued a partial fix. A similar PHP vulnerability was uncovered in 2024 – but was left unfixed.
