Tag

CVE

2 posts

Watching an Unpatched RCE Land: PHP 5.6 Under AddressSanitizer

The advisory patches 8.2 to 8.5 and backports 7.4, 8.0 and 8.1. PHP 5.6 gets nothing. So I built 5.6.40 under AddressSanitizer and sent the advisory's own inputs at it: mod_php takes a real SEGV from two ordinary requests, PHP-FPM survives, and no exploit, it stops at the crash.

October 21, 202610 min read

Read post

PHPSecurityCVEDevOps

PHP's October RCE: Patch First, Then Check What Your Version Number Hides

Two critical, unauthenticated PHP RCEs, patched the same day. The update is the easy part; knowing where you stand is not. Why the distribution version string and the moving image tag both lie, how to check the SAPI that serves traffic, and the interim settings the oldest branches skip silently.

October 21, 202618 min read

Read post