Today's PHP security release, and how we're strengthening security

Posted by ejohnso49 7 hours ago

Today's PHP security release, and how we're strengthening security(thephp.foundation)

Related ongoing thread: PHP 8.2.35 - https://news.ycombinator.com/item?id=50180873

(links to more at https://news.ycombinator.com/item?id=50184935)

597 points | 298 commentspage 3

ChrisArchitect 6 hours ago|

PHP2Shell: AI uncovers critical RCE in PHP

https://news.ycombinator.com/item?id=50180836

Patch the Planet: global response coordination as agents uncover critical vulnerabilities

https://news.ycombinator.com/item?id=50181175

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

https://news.ycombinator.com/item?id=50172041

jooops1 3 hours ago||

So instead of using a memory safe language or harden the C code they hope LLMs will find bugs in their code? Neither do they mention how their way to patch Exceptions into C makes It very difficult for Fuzzers to find those bugs? Good luck this statement should tell everyone to migrate away from that horrible language and runtime.

ThaJay 3 hours ago||

This is what I thought as well. How is this still so popular if it has such fundemental flaws? With the increasing power of LLM, more vulnerabilities will definitely surface sooner or later.

Cthulhu_ 1 hour ago|||

It's one of the biggest runtimes on the internet; the C code will be some of the safest out there. Rewriting to a memory safe(r) language is a huge bet, even today. Nobody's stopping anyone from forking and creating alternative runtimes.

jooops1 1 hour ago||

Yet their response is doing vibe security to this which will never work. From my personal side I don't care about PHP to invest my free time into making such a project. Unfortunately as EU citizen I'm forced to care about PHP's security, because the government thinks It's a good idea to use such It.

topham 3 hours ago||

Please identify a non-toy language that has never had a vulnerability.

jooops1 1 hour ago||

That's irrelevant identify a non-toy language which responds to a serious RCE with vibe security.

cubefox 7 hours ago||

Sounds like a lot went wrong, the 2024 issue not being patched and then multiple parties leaking stuff before the scheduled release date.

NSUserDefaults 2 hours ago||

Very disappointed by Hetzner Ubuntu mirrors not getting updated in time. Had to manually override to get the patch.

Cthulhu_ 1 hour ago|

Same here, I suppose they didn't bother triggering a cron job early? They did patch managed servers and the like according to https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-....

redox99 6 hours ago||

As long as PHP is written in C, it will be insecure.

It sounds cliche but yes, they should rewrite PHP in rust or other memory safe language.

TheJoeMan 5 hours ago||

As long as programmers trust 3rd-party-provided content-length input, it will be insecure. At this point, I'm not sure why we even use content-length anymore since you're going to need to size your buffers based on the actual content.

InsidiousWombat 1 hour ago||

Because when file finishes you want to verify whether the size matches.

And for non-malicious content, you can drop file above the upload max limit before user wastes time sending the file.

berkes 3 hours ago|||

There should be more interpreters or runtimes. Regardless of the language they are written in. Indeed a rustPHP, maybe a JPHP, cPHP, etc etc. There is zend, but AFAIK that's still using the "official" PHP under the hood. And there is or was hiphop. Not sure how that is going, though.

Because now a vulnerability in PHP affects practically 100% of the users. But with more diversity, it would affect only a part. And if one runtime proves insecure more often than another one, organizations have a choice to move to an interpreter that better fits their security needs.

pluc 2 hours ago|||

It's pretty popular in Go: https://frankenphp.dev/

cute_boi 6 hours ago|||

And, i don't understand why we are still using PHP. Agents can use Rust or go directly and we get benefit of performance...

muspimerol 6 hours ago|||

Because like 30% of the websites in the world are on WordPress, and countless others in custom PHP? Not exactly a trivial task.

mbac32768 3 hours ago||

Claude please rewrite my entire WordPress site as an OCaml Mirage Unikernel that runs directly on bare metal, no Linux.

I bet that takes a week at most.

system2 2 hours ago||

While at it, create a custom firmware for the BIOS to utilize the CPU more.

Cthulhu_ 1 hour ago||

In fact, design an FPGA that runs my wordpress blog about my stamp collection in pure hardware. Make no mistakes.

vaylian 6 hours ago||||

and the increased costs of maintenance of a code base that humans will be reluctant to read.

sevenzero 6 hours ago|||

Because its way easier to verify LLM generated code for Laravel over some Rust project. Or do you just vibe it and dont look at code anymore?

rectang 4 hours ago||

I'm generally bullish on migrating C projects to Rust, but that will only reduce a particular class of vulnerabilities. There will still be other vulnerabilities which remain discoverable by LLMs, and for those, the problem of accelerated exploit creation will remain.

I'm really not sure how you mitigate this issue, other than serving static HTML and reducing the attack surface to cut out dependencies like PHP.

bombcar 6 hours ago||

> The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice.

This is the real story. You ship one of them (the breaking change) with —fuck-my-shit-up or something as a compile time option to switch to the other fix.

cubefox 6 hours ago||

The guy who posted the CVE IDs early: https://news.ycombinator.com/item?id=50183326 (dead comment)

xyst 1 hour ago||

"PHP" and "strengthening security" in the same headline is wild.

Having managed applications/servers using PHP in the past. I am so glad to be done with that dumpster fire of an ecosystem.

0x073 52 minutes ago|

Can be said for everything programming language.

wtfphp 3 hours ago|

Hah. Wiz Calif-oAI.

More comments...