Embargo is lifted. #PHP #CVSS10 #infosec
github.com/php/php-src/securit…
github.com/php/php-src/securit…
Patched versions:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
(Some operating systems backport fixes and may have a different version number with the fix. I personally use deb.sury.org on Debian/Ubuntu to have some sanity, but not everyone does, so check your OS for specific guidance.)
RCE via OOM corruption
## Summary PHP uses `longjmp()` for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it ...GitHub
