apparently i was wrong… https://github.com/rust-lang/rust/issues/164250

haven’t watched it yet but apparently this is a good explanation https://www.youtube.com/watch?v=4iAi5exNHv8

the foundation didn’t exist so that one staff member didn’t exist. the foundation doesn’t direct development either, they sponsor development and otherwise help to fund the project.

there is not fault either. hhvm was never a php project. they happened in parallel and there was a lot of good feelings at the time and efforts to collaborate. facebook ended up releasing hack lang and the projects drifted apart.

i think this comment misunderstands what frankenphp and the foundation are.

• its supports php because it is php. its built on top by loading it as a library. it doesnt implement the language so is not and does not want to be a replacement.
• the foundation doesn’t choose where the language goes. They support development in various ways but language design goes through an rfc process influenced by lots of people.
• frankenphp does come up in devel mailing list discussions. i think its largely thought it being an external project is a stregth but also closely part of the project.

because it didn’t support the same features and ended up being a fork of the language called hack.

since it wasnt a replacement and would have required lot of software to be modified or in some cases like wordpress and drupal largely rewritten it never saw wide adoption.

Rust itself doesnt get mant CVEs and its been quiet so thats nice.

its worth noting its a bit different than languages I listed and lower-level. Those languages are also runtimes that provide a large set of features that run with your code.

That means while you could write websites in Rust, reall it is what you might consider writing PHP in if you started in 2026 not an alternative. Its more closely like MUSL(did get a recent big security release 🙄) or glibc.

more references to exploits in the wild.

https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

rihht? opencloud posted a really tacky “nextcloud is dealing with this. checkout open cloud. written in go.”

dude… do we need to drop a link to the golang cves? they had a critical bug this year.

ruby? critical regex rce this week.

nodejs? same.

php made the news because of the embargo break making it go viral and everyone loving to hate on php. But people in glass houses should be careful throwing stones.

yeah the uploadprogress and multipart are caused by php loading the request into memory and that going over the limit. thats the most straightforward and dangerous and one of the mitigations was limiting uplaod sizes. But they triggered it first using Wordpress to trigger the oom. And it sounds like there are ways to cause the form processing to bail without and oom and trigger a similar pointer reuse.

So the post/upload oom are maybe the most interesting but you can bet if people dont patch we’ll see more involved versions. and since php is hidden in things like routers and server management devices and… thats probably a safe bet.

Xbox Developers: Hell yeah! Playstation is shooting themselves in the foot. All we have to do is sit back and we’ll kill it.

Xbox Business : or… hold my beer.

maybe a good reason but definitely the first questions I had.