Summary: Reporting on scare-mongering from Symantec mostly off target

A PHP worm is widely described in the press as a Linux problem, even though PHP runs on many platforms and flaws in PHP are not uncommon. The FUD comes from an insecurity firm, Symantec, which has history of hostility against GNU/Linux. This FUD has occupied the press in recent days. Here is an example from IDG. Somehow a PHP issue gets described as a "Linux worm" (usually in headlines, too) for many other writers to repeat without researching any further. If there is any issue associated with embedded devices (which cannot be patched easily, if at all), then don't blame Linux; embedded systems just happen to be an area reined by Linux and GNU. Windows would not have coped any better.

As Mr. Schneier helps remind us these days [1], proprietary software is a helluva lot worse than GNU/Linux, even if there were some security issues in particular combinations like Linux+PHP. Well, proprietary software is often designed with back doors, as Stuxnet helps remind us (Microsoft works closely with the NSA).

So, before bashing Linux over software that also runs on Windows (PHP) be sure to check which platform has vulnerabilities by design. The most disturbing fact is, nowadays it is common to call out "Linux" when there is some Linux-associated weakness but never call out Windows when only Windows is at fault (as in Stuxnet and NSA back doors).

PHP is rarely used on Windows because performance- and cost-wise Windows is a pile garbage; especially developers should realise this (some develop on Windows/Mac OS X but only ever deploy on GNU/Linux). Why pick on the operating system when the flaw is to some degree platform-agnostic? Maybe it was Symantec's malicious intention again. Symantec makes money from offering remedies to users of a back-doored operating system (like selling insurance for a soon-to-be-broken product). So ignore Symantec's sensationalism and those whom it bamboozled into parroting. ⬆

Related/contextual items from the news:

1. More on Stuxnet