Researcher Finds a Third Critical PHP Vulnerability, With a Three-Line Proof of Concept

Potential third critical PHP CVE

▲ 17mpaepper2 HN discussion
Researcher Finds a Third Critical PHP Vulnerability, With a Three-Line Proof of Concept

Security researcher Elise discovered a double-free bug in PHP that triggers under AddressSanitizer with ZendMM disabled, and it still reproduces on versions 8.4.25, 8.5.10, and 8.5.12. She believes it is a separate flaw from the other PHP issues reported the same day, and has reported it to [email protected] with a three-line proof of concept and a brief explanation. The backtrace is AES-encrypted, with keys to be published once a patch lands.

I keep getting asked about mitigations, here's the mitigation: don't worry about it kitten
Read original →HN discussionRSS

More from this day

2026-10-21