expose_php defaults to off in production

[Slamdunk]

The comment says It is no security threat in any way but I think it is: if an old server exposes a version that is known to be buggy it is far easier to exploit vulnerabilities (e.g. https://www.evonide.com/how-we-broke-php-hacked-pornhub-and-earned-20000-dollar/)

[smalyshev]

It doesn't make any easier to exploit vulnerabilities. It may make easier to know that particular site has some vulnerabilities, but for sites that run old PHP version it'd be just security via obscurity, which is not a good idea. No idea how the link you've posted is relevant to this.

[bukka]

Well it can make targeting the vulnerable version easier for an attacker especially if the attack requires some resources. I have actually seen this reported in some security reviews (private reviews of the website). Personally I don't think it's a big issue but had to disable it anyway. Considering that it doesn't have any value, I would be for disabling it in production ini.

[petk]

What about adding a new optional header X-Powered-By that would show only PHP and no version?

So, instead of this in the production:

X-Powered-By: PHP/7.2.9

this might be more appropriate:

X-Powered-By: PHP

That way, PHP is still advertised in this output yet with a bit less security concerns. Otherwise, I think today most apps disable this header or adjust it differently. For development it's good to know the version though.

[nikic]

@petk Only showing the minor version (PHP/7.2 or PHP/7.2.99) would be another possibility. Still allows gathering version stats without exposing the exact patch level.

[KalleZ]

Either way, I think this is something that should be discussed at least on internals first before a decision should be made in regards to this

[php-pulls]

Comment on behalf of petk at php.net:

Labelling

[petk]

Some labels applied to help organize issues here better. To see how to bring this up to the internals mailing list see info at http://php.net/mailing-lists.php

In case there is a need for help with bringing this up to the mailing list let me know to ask there for more views what to do here. Personally, I would go for what was suggested above: X-Powered-By: PHP 7.2 because there are actual sites out there that want to show this info. Security concern with showing this particular information is not more problematic than other aspects of the site.

[krakjoe]

This appears to have gone stale, so closing now.

The change would be all but meaningless anyway, we don't really decide configuration, package maintainers do.