Post

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

Top story: two critical remote code execution bugs in PHP itself, both CVSS 9.2. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix them, out Oct 21, a day early. RCE was validated against mod_php with default limits. There are no complete mitigations: update.

How it breaks: when PHP runs out of memory it long-jumps out mid-operation, and can leave half-built request data for cleanup to trust. The second bug leaves a pointer into the last request's freed memory for the next request on that worker.

The fix, by Arnaud Le Blanc with Ilija Tovilo, Jakub Zelenka, Nora Dossche and @nicolasgrekas.bsky.social: no more jumping out of out-of-memory. PHP flags it and stops at the next safe point, with a new hard limit as a backstop. 389 files touched.

Finland, France, the Netherlands and Canada took some government sites offline until they could patch. Dan Lorenc said exploits had hit the wild; @naderman.de: "There were no confirmed exploits." The PHP team and CISA hadn't seen any at release.

From the week we missed: Damian Jóźwiak's RFC proposes a CSV extension for core, built on Gina Peter Banyard's. Artem Ukrainskiy argues the existing functions can be fixed instead. Damian laid out 3 directions and offered a directional vote.

Otar Chekurishvili's RFC adds two opt-in json_decode flags: comments and trailing commas. @timwolla.bsky.social called it "incredibly well-written", and Larry Garfield has "no remaining objections to it."