alt Hacker NewsPHP 8.2.35
Related ongoing thread: Today's PHP security release, and how we're strengthening security - https://news.ycombinator.com/item?id=50182987
Comments
Available for Trixie :) (https://lists.debian.org/debian-security-announce/2026/msg00...)
Why is the official source (php.net) marked as [dupe] https://news.ycombinator.com/item?id=50180943
and not the github mirror?
I’m not especially technical, but I have clients with WordPress websites. Can anyone perhaps put in a sentence or two what I need to suggest they do?
https://github.com/php/php-src/commit/01a40e89fbfc499936e3b0...
What everyone is looking for.
Have we ever seen the "get ready for a security release tomorrow" email before?
https://github.com/consocio/php2shell-audit/ GLM 5.3 just wrote it to audit all my php sites. I hope it is useful to you.
Any signs of exploits out yet?
https://github.com/consocio/php2shell-audit/
GLM 5.3 just wrote it to audit all my php sites. I hope it is useful to you
Apparently about 40% of PHP apps are still on PHP 7 and 5...
A bit too early for the announced coordinated release, no?
PHP 8.3.36 (cli) (built: Oct 21 2026 08:18:34) (NTS)
made it in time hopefully
Time to restart Apache again!
"I'm not a real programmer. I throw together things until it works then I move on. The real programmers will say 'Yeah it works but you're leaking memory everywhere. Perhaps we should fix that.' I’ll just restart Apache every 10 requests." -Rasmus Lerdorf
Anyone know if Microsoft updates azure web-app built-in php runtimes fairly quickly in this sort of scenario?
I have this slight suspicion this was not the last critical PHP apocalypse ... :(
Some web-services are back up again here in central Europe, but some are not, which is very annoying. Kind of surprising to see how much PHP is actually used. Hate it or love it, PHP really is very important still - lots of the web depends on it.
Looks like the upgrade instructions for PHP 8.3 for Fedora 39 and earlier are not working ... yikes.
Is PHP 7 essentially going to be dead and unusable for everyone then? Or will it get fixes?
Seems like 4chan is down for maintenance as a result.
So they've added malloc fail checks and tests for malloc fail throughout.
Is this even reachable on Linux due to overcommit? Maybe by attempting a single extremely large allocation?
This reminds me of the old days when PHP was such a vulnerable language.
By simply searching for websites that used local includes to load other pages, you could get RCE.
At this point, running webapps in JS workers/sandboxes sounds like a good idea. Vendors take care of patching.
Anyone know when amazon linux 2023 is releasing updates?
While the fix was not published I genuinely thought a quick service rewrite to some other stack (say Go) would make sense as a fix. (Assuming high integration test coverage )
I think there's a lot to learn from the last twenty four hour's events. An absolute nuclear bomb of an exploit affecting every version of PHP back to 2012 (which nobody should be using of course, but I've worked in plenty of environments that are not up to date).
The thing that's annoyed me the most is the speculation and misinformation, filling in the gaps. Folks looked into the php-src and figured out one of the vulnerabilities, starting saying you should disable certain php settings and then core PHP developers on obscure mailing lists hinting this isn't enough.
Given how inexpensive it is for agents to scan popular OSS projects, disclosure needs to be more discrete and you cannot publish fixes to OSS before disclosure. People will be and are watching for this kind of thing already.
This is pure gold. A critical vuln like this is such classic lolphp. Luckily you can port away from PHP pretty easily with AI.
> 8.1 and earlier Not patched: these versions have reached end of life and will not receive an official fix
I would not recommend using PHP. The PHP team keeps breaking backward compatibility and trying to introduce new features instead of focusing on fixing bugs and hardening the compiler.
PHP runs literally half the web. Half the web will not apply this patch in any reasonable amount of time (a huge portion will never). This is going to be absolutely catastrophic.
Log4J4PHP
Doing a...
docker pull wordpress:fpm && docker image inspect wordpress:fpm --format '{{.Created}}' && docker run --rm wordpress:fpm php --version
So far, no dice.
Why they can't publish an expoit so people can run it against their own servers to check the impact?
where is patch for alpine?
What I've been feeling lately is that security vulnerabilities will inevitably keep being discovered, and I worry whether humans can ever patch all of them.
They bundled the fixes with a regular bugfix release, looks like.
apt update
apt upgrade
This is extremely damning for Cloudflare. I had a bunch of clients telling me Cloudflare is all they need to prevent this, and they want to get that on their site instead of upgrading PHP.
I have not seen confirmation Cloudflare is doing anything except playing whack a mole with certain request patterns. PHP Core Devs have been clear you need to upgrade. If this is true, it's disgustingly opportunistic that Cloudflare is using this critical security time to lie to people that they are safe.
Anyone from Cloudflare want to speak to this?
[dead]
[dead]
[dead]
[dead]
[dead]
Gentoo has it updated.