alt Hacker NewsSomeone is saying there is a new vulnerability that works on the newest 8.5.12 https://x.com/_annieversary/status/2112933589943742598
Replies
jerf • today at 6:31 PM
Is there anywhere good to get some sort of reliable stream of information about this possibility?
It's going to be pretty bad if we all panic to get the latest PHP up, and all confidently roll out our updated websites, just for them to still be vulnerable to something serious anyhow.
rafael-lua • today at 6:03 PM
Mr. President...
johng • today at 5:54 PM
Anymore on this, I'm upgrading to 8.5.12 now and don't want to still be vulnerable?
➕ show 1 reply
That partial stack trace linked above seems to match this GitHub issue, which has much more information: https://github.com/php/php-src/issues/24488 (double-free introduced in 8.5.12)
From what I can see, this causes a crash only, and isn't weaponisable. It's a use-after-free, but the reclaim window is zero by construction.