Today's PHP Security Release, and How We're Strengthening PHP Security

The PHP foundation's write-up if the two critical vulnerabilities that allowed for remote code execution. That cover the work that went into discovering it, external AI-assisted audits, and shortcomings.

The shortcoming included problems with resolving a known OOM issue that was later find to be more serious. They have outlined changes made with how security is handled moving forward. There were also issues with disclosure of the vulnerabilities by vendors. Rumours of the vulnerabilities started to circulate, security research firm, Calif, accidentally released a video of the exploit, and Chainguard broke the embargo by publishing a patch early. Yikes.

Now that the patches are officially out: - Calif released their detailed write-up with a teaser of php3shell, whatever that means. - Calif used GPT Sol so OpenAI had their moment. - Wiz having also discovered this vulnerability around the same time as Calif released their write-up. - Their discovery was powered by Gemini Argon and it is now Google's turn to bask in the sun. - Lobste.rs user, Yogurt, linked to the code change that fixes these vulnerabilities. It's large! - This entire ordeal was messy, ShellSharks gathers somes observations of their own.