Len Woodward

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

This week's episode is supported by Scalpels: open source apps that each replace a paid service, forked into your GitHub org and deployed to your own Laravel Cloud. The platform that manages them is one lifetime purchase, not another subscription. https://scalpels.app

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

Quick hits: Máté Kocsis answered @timwolla.bsky.social's 14-point query params review. Tim sent Jakub Zelenka 15 more on polling. Marc wants getNanoOfSecond. Tim backs David Carlier's IntlNumberFormatter, and Juliette Reinders Folmer is on the b prefix.

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

Calvin Buckley's RFC adds binary parameters to PDO. Ilia went through it driver by driver: PARAM_LOB is already binary in some, and a driver that doesn't know the new type falls back to text, or to a fatal error in pdo_sqlsrv.

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

Back to this week: PHP voted 40–0 to stop endorsing PEAR, @nicksdot.dev's RFC. Sebastian Bergmann wants the archive switched off safely: signed SHA-256 hashes, a pinned installer hash, brown-outs, and a tombstone PHAR instead of a 404.

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

Sjoerd Langkemper's PASSWORD_BCRYPT_SHA256 got its first challenge: Mirco Babin asked who vouches for it and pointed to OWASP. Rowan Tommins says the HMAC's salt does the job of OWASP's pepper, and Andrey Andreev has an alternative coming.

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

From the week we missed: Damian Jóźwiak's RFC proposes a CSV extension for core, built on Gina Peter Banyard's. Artem Ukrainskiy argues the existing functions can be fixed instead. Damian laid out 3 directions and offered a directional vote.

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

The CVE IDs leaked online Tuesday with the wrong score. The release moved up a day, Calif posted and pulled an exploit video, and the PHP Foundation says Chainguard broke the embargo hours early. On the delay since 2024: "a structural failure."

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

How it breaks: when PHP runs out of memory it long-jumps out mid-operation, and can leave half-built request data for cleanup to trust. The second bug leaves a pointer into the last request's freed memory for the next request on that worker.

Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode. https://youtu.be/4ze2Re_-gMQ #PHP #PHPInternals #PHP86

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

This week's episode is supported by Scalpels: open source apps that each replace a paid service, forked into your GitHub org and deployed to your own Laravel Cloud. The platform that manages them is one lifetime purchase, not another subscription. https://scalpels.app

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Quick hits: Weilin Du takes array shorthand back to the colon. Daniel Scherzer put the b string prefix in the 8.7 deprecations RFC after Juliette Reinders Folmer stepped back. Muhammed Arshid's filter RFC is now backed enums.

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Ilia ran Jakub Zelenka's IO Hooks branch, found crashes under Fibers, and would make hooked calls opt-in. Jakub: fixable, not a design issue. Edmond Dantes: "now we have both halves: Scheduler + IO Hooks."

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Io\Terminal v0.4 dropped its interfaces: @timwolla.bsky.social argued the real boundary is the stream, not the terminal, and Bob Weinand agreed. Larry Garfield sketched tests with in-memory streams, and Pratik Bhujel is heading toward a vote.

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Two votes are open after 7 straight episodes with none. @nicksdot.dev's RFC to end PEAR's endorsement was 26–0 at recording (closes Oct 19). Weilin Du's IntlRelativeDateTimeFormatter is back with @timwolla.bsky.social's enum design: 7–0, Tim included (closes Oct 22).

PHP's default password hash only reads the first 72 bytes of your password. Last week's plan to refuse longer ones split the list. This week, a fix that breaks nothing arrived, borrowed from a Python library. https://youtu.be/HHhoh-7H37A #PHP #PHPInternals #PHP87

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

This week's episode is supported by Scalpels: professionally built, open source alternatives to the parts you actually use of things like Private Packagist, Mailtrap and remove.bg. Forked into your GitHub org, deployed to your own Laravel Cloud, all MIT. https://scalpels.app

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

Quick hits: Matteo Beccati's PHP 8.6.0 RC2 is out (RC1 was skipped over a packaging error), plus security releases for 8.5, 8.4, 8.3 and 8.2. Sjoerd's number-base RFC now throws an Exception, not a ValueError. Juliette Reinders Folmer wants the b string prefix deprecated.

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

Jakub Zelenka's IO Hooks RFC would hand PHP's blocking calls (streams, sockets, curl, sleep) to a provider such as an event loop, so existing code runs concurrently under Fibers. No provider, no change. It builds on a second new RFC, Polling API Additions.

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

Time\Instant got a bridge from DateTime: toInstant(). @timwolla.bsky.social and Derick Rethans won't write the testing-clocks RFC, and they're inviting the community to. Mirco Babin flagged a clash with PSR-20's now(). Morgan: "Well, then it's not an instant, is it?"

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

Gina P. Banyard's CompiledRegex prototype drew 18 replies, and several want it called just Regex: Larry Garfield, Casper Langemeijer, Jordi Kroon, Juris Evertovskis. Ayesh Karunaratne and @seld.be want to build one from the patterns you already have.

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

One of the many things we've been working on lately at Artisan Build is finally ready to start being talked about publicly! But it's still early, and we only want to include people in our immediate networks for now. So if you're seeing this, that means you. scalpels.app/street-team

Scalpels is our solution. We build it, completely open source. You can fork each service, host it yourself, but then to get updates you can just pull from our upstream. You can PR fixes back.

One of the many things we've been working on lately at Artisan Build is finally ready to start being talked about publicly! But it's still early, and we only want to include people in our immediate networks for now. So if you're seeing this, that means you. scalpels.app/street-team

We (and our clients) seem to have this ever-growing portfolio of monthly subscriptions for tiny apps that do just one little thing each. And it's getting a bit old.