The trick: Scope Swap
The 70% is how much of the web runs PHP.
It is not a count of sites hacked, or even sites still open once they patch.
AI uncovered critical PHP flaws affecting 70% of the internet.
Before you read on. Your call?
TRUE, BUT
69.3%
PHP has fixed two critical remote code execution flaws. The 70% is PHP's share of websites, and PHP's own advisory says exploit reliability depends on the build and setup. Calif says it found the first bug with a generally available model.
There’s more to this story.
Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.
30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.
Review my 30-day free trial →- At sign-up: 30 days free. Payment card required. One introductory trial per customer.
- Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
- You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing hello@bskiller.com. This voluntary refund does not limit your rights under the Australian Consumer Law.
By starting your trial, you agree to the Terms.
BS Killer is published by Inferno Tech Pty Ltd, ABN 27 647 413 474.
Get tomorrow’s check free by email.
Couldn't check your access. That's on us.
The trick has a name
We call it Scope Swap: applies to far less than it sounds like. You'll see it again. Learn to spot it →
Receipts
- Context wiz.io:
a popular general-purpose scripting language that powers 70% of all websites in the world.
- Supports wiz.io:
Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4.
- Supports wiz.io:
a single researcher completed in a week what previously would have taken a world-class team months of work.
- Supports php.net:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.
- Context php.net:
There are no complete mitigations, updating is the only safe choice.
- Context php.net:
PHP 8.1 and older no longer receive updates from the PHP project.
- Supports github.com:
The confirmed impact is unauthenticated remote code execution as the web worker account.
- Refutes github.com:
Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout.
- Refutes calif.io:
No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery.
- Refutes w3techs.com:
PHP is used by 69.3% of all the websites whose server-side programming language we know.
Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.
