Post

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

Top story: two critical remote code execution bugs in PHP itself, both CVSS 9.2. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, out Oct 21, a day early. RCE was validated against mod_php with default limits. There are no complete mitigations: update.

How it breaks: when PHP runs out of memory it long-jumps out mid-operation, and can leave half-built request data for cleanup to trust. The second bug leaves a pointer into the last request's freed memory for the next request on that worker.

The CVE IDs leaked online Tuesday with the wrong score. The release moved up a day, Calif posted and pulled an exploit video, and the PHP Foundation says Chainguard broke the embargo hours early. On the delay since 2024: "a structural failure."

Finland, France, the Netherlands and Canada took some government sites offline until they could patch. Dan Lorenc said exploits had hit the wild; @naderman.de: "There were no confirmed exploits." The PHP team and CISA hadn't seen any at release.

From the week we missed: Damian Jóźwiak's RFC proposes a CSV extension for core, built on Gina Peter Banyard's. Artem Ukrainskiy argues the existing functions can be fixed instead. Damian laid out 3 directions and offered a directional vote.