throwaway800BC
Re:PHP2Shell: Exploitation Attempts and Remediation Trends
on Tuesday October 27, 2026 @12:39PM (#50261806)
Awesome that you looked into this!
Have you been able to run any benchmarks? (Are there any benchmarks for this kind of thing?) IDK, seems kind of silly when talking about PHP and webservers but people were concerned when I suggested it in the original thread.
In particular, it is mentioned that the `Zend` allocator does not play well with fine-grained tracking (so would not have caught this issue?) and you need to swap to the system allocator.
Re:Upcoming Critical PHP Security Release
on Wednesday October 21, 2026 @01:29AM (#50176427)
Took a quick peak at the relevant C code and what I think are the offending lines seem somewhat suspicious right off the bat.
Fil-C should have caught this right? I wonder if it would benefit the PHP ecosystem as a whole if the releases are built with it instead.