@GossiTheDog@cyberplace.social
2026-10-22 08:31 UTC
Regarding the rumours the PHP patches don’t fix the vulnerabilities - it’s not true, they patched the vulnerabilities of issue.
The rumours are also separate issue which people are mixing up. Don’t panic about that one.
https://fedi.katze.sh/@elise/117480160480660575
Replies (2)
-
@jamesh@aus.social 2026-10-22 11:01
@GossiTheDog@cyberplace.social There's a lot more setjmp/longjmp use in there, which would make it even harder to reason about the code than normal for a project like this. Combine that with trying to handle out of memory conditions without terminating, and I wouldn't be surprised if there are a lot more bugs out there. I can understand why you wouldn't want mod_php taking down the web server in these cases, but perhaps that just means putting the language runtime inside the web server is a bad idea.
-
@GossiTheDog@cyberplace.social 2026-10-22 17:52
Yep. https://infosec.exchange/@mayahustle/117485672263060599