PHP Internals

Watching an Unpatched RCE Land: PHP 5.6 Under AddressSanitizer

The advisory patches 8.2 to 8.5 and backports 7.4, 8.0 and 8.1. PHP 5.6 gets nothing. So I built 5.6.40 under AddressSanitizer and sent the advisory's own inputs at it: mod_php takes a real SEGV from two ordinary requests, PHP-FPM survives, and no exploit, it stops at the crash.