Comment by cloudlandsdev
18 hours ago
Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page. From the traffic, it seems plausible that some people have an theoretical exploit path through PHP's HTML server itself, without relying on PHP functions, but no one has pulled it off quite yet.
I’m not sure I’m understanding this comment [0] correctly, but even back then it seemed possible to get PHP involved?
[0]:<https://news.ycombinator.com/item?id=50225861>
No, PHP always just tacks that on, even when only serving static files.
what exactly is this testing or proving? do you even have session support enabled? https://news.ycombinator.com/item?id=50234093