When you pry a bit deeper in these cases, you will notice that these victims almost always use some 3rd party content management system written in PHP, like Wordpress or Joomla.

There are some problems with these:

• They had lots of security vulnerabilities in the past.
• There are lots and lots of plugins available for them of varying quality which also have vulnerabilities.
• Uploading files is part of the core functionality of a CMS, so security-related bugs which allow to abuse this functionality unauthenticated is actually quite conceivable.
• People tend not to update these systems as often as they should, so installations with unpatched vulnerabilities stay online.
• There is a huge number of installations for these, so they can be easily found through automated bots.

You might wonder why are there so many problems with PHP applications? PHP is a language which used to have quite lax security practices. Its paradigms easily led to XSS and SQL injections.

As a C programmer, these affect you less, but you have a whole set of different problems, like for example having to think about buffer overflows whenever you write data to a char* or other type of array.

When you pry a bit deeper in these cases, you will notice that these victims almost always use some 3rd party content management system written in PHP, like Wordpress or Joomla.

There are some problems with these:

• They had lots of security vulnerabilities in the past.
• There are lots and lots of plugins available for them of varying quality which also have vulnerabilities.
• Uploading files is part of the core functionality of a CMS, so security-related bugs which allow to abuse this functionality unauthenticated are actually quite conceivable.
• People tend to not update these systems as often as they should, so installations with unpatched vulnerabilities stay online.
• There is a huge number of installations for these, so they can be easily found through automated bots.

You might wonder why are there so many problems with PHP applications? PHP is a language with several paradigms which make it quite easy for a novice programmer to write insecure applications full of XSS and SQL injections. Also, PHP files do not need to be compiled and are usually immediately accessible under an URL. A .PHP file on a webserver can be executed just by requesting them with a web browser, so when the attacker manages to upload one, they have already pwned the server.

As a C programmer, these problems affect you less, but you have a whole set of different problems, like for example having to think about buffer overflows whenever you write data to a char* or other type of array.