Blackcap Blog

Published at 18:08 on 22 October 2026

This site was down for a few days. Yes, it was related to the recently-announced PHP2Shell vulnerabilities. No, no security incidents happened on this site that I am aware of. I preemptively took the site down until I could update PHP and remove the vulnerabilities.

What’s amusing is all the temper tantrums about PHP that this prompted. People were huffily announcing that PHP should be phased out post-haste. I get it: PHP is a pretty awfully-designed programming language. But, as I wrote a little over five years ago, it doesn’t matter: market-leading packages like WordPress are written in PHP, and if you want to run them, you have to run PHP.

And, in this case, I had to do a little coding in PHP, because stock WordPress didn’t quite do all I wanted out of the box. Because WordPress is so well designed, it was simple to extend. Because it is so well documented, it was easy to figure out how to do it. I am better off writing several dozen lines of code in PHP (code that I can just write, thanks to good documentation), than I am writing many hundreds of lines of code in some other, theoretically superior, programming language (code that takes lots of painful trial and error, thanks to lousy documentation).

But back to the temper tantrums. People were talking about uninstalling PHP and using packages written in some other programming language. Just ridiculously impractical for code that already mostly works as intended anyhow. Sure, there was a security hole in PHP. There have been security holes in all sorts of software systems, including the Linux kernel, yet you don’t hear the same people saying not to use Linux. PHP is one of the key technologies powering the Web today; as such, of course there was going to be a security patch promptly released to address the issue. As indeed there was. Problem solved, no painful, expensive rewrite needed.

I do work on programming projects as a hobby from time to time. This blog is not one of them; it is something I mostly want to just work. Thanks to WordPress, PHP lets me do that easier than any other alternative, so it is PHP that powers this site.

As such things often are. The decision of which programming language to use is almost never based solely on the capabilities and attributes of the core programming language. Instead, it typically comes down to the libraries and subsystems that programming language gives you access to.