reading this writeup i’m not really sure if my project would have even been vulnerable to this, because the possibility of such attacks were already anticipated with built in flood limits, like the size of the request is limited by the length of the URL, the number of model operations, and the template engine is only going to output a page of a certain size, also number of active users, requests per minute / hour etc. and so the maximum possible requests from the client is going to be way lower than the internal php memory limit

I guess most people who write php don’t operate with the assumption that there are serious problems inherent to php that should be mitigated structurally, and they just expose everything via a central controller

like you should never let your users make such a large request or so many requests simultanously it uses up all your RAM? like obviously?

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/