alt Hacker NewsPHP 8.2.35
Related ongoing thread: Today's PHP security release, and how we're strengthening security - https://news.ycombinator.com/item?id=50182987
Comments
They have to backport this fix or else leave a large part of the internet broken.
https://github.com/php/php-src/commit/01a40e89fbfc499936e3b0...
What everyone is looking for.
Available for Trixie :) (https://lists.debian.org/debian-security-announce/2026/msg00...)
Have we ever seen the "get ready for a security release tomorrow" email before?
Why is the official source (php.net) marked as [dupe] https://news.ycombinator.com/item?id=50180943
and not the github mirror?
I’m not especially technical, but I have clients with WordPress websites. Can anyone perhaps put in a sentence or two what I need to suggest they do?
...and If you have a server in a closet still running PHP 5 or 7, hosting that project you’ll rewrite “next quarter,” this might buy you some time: https://github.com/analogic/phpsafepass
A bit too early for the announced coordinated release, no?
https://github.com/consocio/php2shell-audit/ GLM 5.3 just wrote it to audit all my php sites. I hope it is useful to you.
Any signs of exploits out yet?
Time to restart Apache again!
"I'm not a real programmer. I throw together things until it works then I move on. The real programmers will say 'Yeah it works but you're leaking memory everywhere. Perhaps we should fix that.' I’ll just restart Apache every 10 requests." -Rasmus Lerdorf
Anyone know if Microsoft updates azure web-app built-in php runtimes fairly quickly in this sort of scenario?
there is clearly some drama w.r.t. who takes credit here, 3 companies credited for a single flaw is super odd.
Looks like the upgrade instructions for PHP 8.3 for Fedora 39 and earlier are not working ... yikes.
PHP 8.3.36 (cli) (built: Oct 21 2026 08:18:34) (NTS)
made it in time hopefully
Is PHP 7 essentially going to be dead and unusable for everyone then? Or will it get fixes?
So they've added malloc fail checks and tests for malloc fail throughout.
Is this even reachable on Linux due to overcommit? Maybe by attempting a single extremely large allocation?
This reminds me of the old days when PHP was such a vulnerable language.
By simply searching for websites that used local includes to load other pages, you could get RCE.
At this point, running webapps in JS workers/sandboxes sounds like a good idea. Vendors take care of patching.
Seems like 4chan is down for maintenance as a result.
I'll give a shoutout to Lithium Hosting. I was able to log in and update my PHP Pool per their custom control panel and switch all of my sites over to the latest fix: 8.5.12.
Anyone know when amazon linux 2023 is releasing updates?
I think there's a lot to learn from the last twenty four hour's events. An absolute nuclear bomb of an exploit affecting every version of PHP back to 2012 (which nobody should be using of course, but I've worked in plenty of environments that are not up to date).
The thing that's annoyed me the most is the speculation and misinformation, filling in the gaps. Folks looked into the php-src and figured out one of the vulnerabilities, starting saying you should disable certain php settings and then core PHP developers on obscure mailing lists hinting this isn't enough.
Given how inexpensive it is for agents to scan popular OSS projects, disclosure needs to be more discrete and you cannot publish fixes to OSS before disclosure. People will be and are watching for this kind of thing already.
While the fix was not published I genuinely thought a quick service rewrite to some other stack (say Go) would make sense as a fix. (Assuming high integration test coverage )
For those who can’t patch their PHP for a variety of reasons right now, here is a proxy I developed that can sit between nginx or apache and your PHP-FPM, to sanitize inputs and prevent this (and other) attacks:
This is pure gold. A critical vuln like this is such classic lolphp. Luckily you can port away from PHP pretty easily with AI.
I have this slight suspicion this was not the last critical PHP apocalypse ... :(
Some web-services are back up again here in central Europe, but some are not, which is very annoying. Kind of surprising to see how much PHP is actually used. Hate it or love it, PHP really is very important still - lots of the web depends on it.
PHP runs literally half the web. Half the web will not apply this patch in any reasonable amount of time (a huge portion will never). This is going to be absolutely catastrophic.
> 8.1 and earlier Not patched: these versions have reached end of life and will not receive an official fix
I would not recommend using PHP. The PHP team keeps breaking backward compatibility and trying to introduce new features instead of focusing on fixing bugs and hardening the compiler.
Doing a...
docker pull wordpress:fpm && docker image inspect wordpress:fpm --format '{{.Created}}' && docker run --rm wordpress:fpm php --version
So far, no dice.
Log4J4PHP
Why they can't publish an expoit so people can run it against their own servers to check the impact?
where is patch for alpine?
What I've been feeling lately is that security vulnerabilities will inevitably keep being discovered, and I worry whether humans can ever patch all of them.
They bundled the fixes with a regular bugfix release, looks like.
apt update
apt upgrade
This is extremely damning for Cloudflare. I had a bunch of clients telling me Cloudflare is all they need to prevent this, and they want to get that on their site instead of upgrading PHP.
I have not seen confirmation Cloudflare is doing anything except playing whack a mole with certain request patterns. PHP Core Devs have been clear you need to upgrade. If this is true, it's disgustingly opportunistic that Cloudflare is using this critical security time to lie to people that they are safe.
Anyone from Cloudflare want to speak to this?
[dead]
[dead]
[dead]
Gentoo has it updated.