ugh. the patch is massive 🫩 the bug is based on causing an OOM condition and no-one ever accused the php interpreter of being neatly and elegantly architected, so the fix touches everything 🫩 the bugs go back many years but backporting the fix to all those versions is wildly impractical 🫩

the exploit was developed with AI assistance but it was based on existing human research, including by my old nemesis Stefan Esser. I don't remember why he's my nemesis, I assume we got into a stupid twitter argument over nothing like 16 years ago