News for hackers. Stuff that matters.

throwaway800BC

Re:PHP2Shell: Exploitation Attempts and Remediation Trends on Tuesday October 27, 2026 @12:39PM (#50261806)
Awesome that you looked into this!

Have you been able to run any benchmarks? (Are there any benchmarks for this kind of thing?) IDK, seems kind of silly when talking about PHP and webservers but people were concerned when I suggested it in the original thread.

In particular, it is mentioned that the `Zend` allocator does not play well with fine-grained tracking (so would not have caught this issue?) and you need to swap to the system allocator.

Re:Upcoming Critical PHP Security Release on Wednesday October 21, 2026 @01:29AM (#50176427)
Took a quick peak at the relevant C code and what I think are the offending lines seem somewhat suspicious right off the bat.

Fil-C should have caught this right? I wonder if it would benefit the PHP ecosystem as a whole if the releases are built with it instead.