Post

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

Top story: two critical remote code execution bugs in PHP itself, both CVSS 9.2. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, out Oct 21, a day early. RCE was validated against mod_php with default limits. There are no complete mitigations: update.

How it breaks: when PHP runs out of memory it long-jumps out mid-operation, and can leave half-built request data for cleanup to trust. The second bug leaves a pointer into the last request's freed memory for the next request on that worker.

The fix, by Arnaud Le Blanc with Ilija Tovilo, Jakub Zelenka, Nora Dossche and @nicolasgrekas.bsky.social: no more jumping out of out-of-memory. PHP flags it and stops at the next safe point, with a new hard limit as a backstop. 389 files touched.

The CVE IDs leaked online Tuesday with the wrong score. The release moved up a day, Calif posted and pulled an exploit video, and the PHP Foundation says Chainguard broke the embargo hours early. On the delay since 2024: "a structural failure."

Finland, France, the Netherlands and Canada took some government sites offline until they could patch. Dan Lorenc said exploits had hit the wild; @naderman.de: "There were no confirmed exploits." The PHP team and CISA hadn't seen any at release.

From the week we missed: Damian Jóźwiak's RFC proposes a CSV extension for core, built on Gina Peter Banyard's. Artem Ukrainskiy argues the existing functions can be fixed instead. Damian laid out 3 directions and offered a directional vote.

Otar Chekurishvili's RFC adds two opt-in json_decode flags: comments and trailing commas. @timwolla.bsky.social called it "incredibly well-written", and Larry Garfield has "no remaining objections to it."

Sjoerd Langkemper's PASSWORD_BCRYPT_SHA256 got its first challenge: Mirco Babin asked who vouches for it and pointed to OWASP. Rowan Tommins says the HMAC's salt does the job of OWASP's pepper, and Andrey Andreev has an alternative coming.

@mnapoli.bsky.social's single binary flipped: php-fpm now carries the CLI and picks its mode by name. @timwolla.bsky.social wants an explicit php --fpm, Marc Henderkes agrees, and Levi Morrison floated a shared libzend.so.

Back to this week: PHP voted 40–0 to stop endorsing PEAR, @nicksdot.dev's RFC. Sebastian Bergmann wants the archive switched off safely: signed SHA-256 hashes, a pinned installer hash, brown-outs, and a tombstone PHAR instead of a 404.

Weilin Du's IntlRelativeDateTimeFormatter passed 25–0 and is merged for 8.7. Sjoerd Langkemper's RFC to make hexdec and friends throw was 22–1 at recording, the no over a bare Exception. Muhammed Arshid's Filter enums: 1–10.

Calvin Buckley's RFC adds binary parameters to PDO. Ilia went through it driver by driver: PARAM_LOB is already binary in some, and a driver that doesn't know the new type falls back to text, or to a fatal error in pdo_sqlsrv.

Sjoerd Langkemper reopened SSRF protection in curl. @beoneself.bsky.social's plan is now narrower: just CURLOPT_OPENSOCKETFUNCTION, with a callback that sees the address and port. He's building it as an extension first.

Quick hits: Máté Kocsis answered @timwolla.bsky.social's 14-point query params review. Tim sent Jakub Zelenka 15 more on polling. Marc wants getNanoOfSecond. Tim backs David Carlier's IntlNumberFormatter, and Juliette Reinders Folmer is on the b prefix.

This week's episode is supported by Scalpels: open source apps that each replace a paid service, forked into your GitHub org and deployed to your own Laravel Cloud. The platform that manages them is one lifetime purchase, not another subscription. https://scalpels.app