As we know, Suhosin hardens PHP and adds another layer of security. But unfortunately there is no official release for PHP 5.4/5.5 (that I can find anyway).

So that puts me in a small dilemma. Do I go with the newer PHP 5.4/5.5 which I presume are more secure than the older 5.3, or do I go with the older PHP 5.3 but with the security hardening patch of Suhosin?

Currently on my local machine I am running my code with PHP 5.3.5, so there is nothing inherently in PHP 5.4/5.5 that I need for my scripts to work. Security is paramount in this project though!

What is recommended in this instance? Or does it not matter? Suhosin seems to have some nice patches.



The most secure PHP version is the one you keep updated. Which version (and associated libraries) are maintained by an upstream provider (your Linux distro, assuming you're running Linux.) Are you building the binaries yourself? If so, make sure that you allocate the time needed to keep up with all security patches, not just in PHP, but also in libraries required by your application.

| improve this answer | |
  • +1 for well argued answer - but in the case of PP a further question is whether you want to switch ZOP+ insead of APC. – symcbean Jan 1 '14 at 23:13

The Suhosin Extension v. 0.9.36 is available on suhosin.org and github. Supported PHP versions are PHP 5.4 and PHP 5.5.

The Suhosin Patch has not yet been ported to current PHP versions.

Even without additional PHP patches from the Suhosin Patch, a current PHP version with the Suhosin extension is definitely more secure than outdated versions PHP < 5.4, that won't officially receive security related patches anymore.

Suhosin provides a wide range of security related enhancements for PHP including

  • cookie and session encryption
  • blacklisting and whitelisting functions, eval'd functions, includes
  • protection against SQL injection
  • various input filters and limits
  • secure random number re-seeding
  • logging and protection simulation

On top of keeping your PHP installation up to date, these features can provide a distinct advantage in securing your application, that PHP would not provide otherwise out of the box. This may be of particular interest when running third-party applications and close-source/encrypted applications, where code quality is not known.

| improve this answer | |

Suhosin is an old idea/concept which really is no longer a relevant in this day and age. It's just as bad as people who think disabling PHP functions makes a server secure. Just keep PHP updated and focus on securing the server and services.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.