The progress of MOPB

The Month of PHP bugs is progressing nicely and the counter is up to nine (at this rate - supposing that we have a linear progression - we will have almost 70 vulnerabilities!). The new ones repeat the same patterns as the previous ones: they can be mitigated in environments where a single user controls the server, but in a shared hosting environments they can present serious problems (for example this bug - MOPB-05-2007: PHP unserialize() 64 bit Array Creation Denial of Service Vulnerability allows to very easily DoS the computer if it's running an older version of PHP on a 64 bit machine).

My advice remains the same: forget shared hosting (both as a client and as a Service Provider) and patch, patch, patch - also consider things like Suhosin and mod_security. I know that (especially the later) can be a pain in the rear end to configure, but the alternative - being owned or DoS-ed out of existence - is by no means better.

PS. This week seems to be a bad one for PHP security since the distribution server for Wordpress (a popular blogging platform written in PHP) was compromised - my respect to them for saying cracker, not hacker - and contains a backdoor. Via Slashdot.