Oct 21, 2026, 3:24 PMthe PHP security bug patch is a nightmare, our server is patched but this thing looks more like a desperate attempt to patch hundreds of different leaks than a straightforward single bugfix, I do not trust that this is over…
- Oct 21, 2026, 3:24 PM
Replies
- Oct 21, 2026, 4:12 PM
PHP is a million or so lines of C code that pervasively used alloc functions that longjmp() on failure, so OOM bailout creates corrupted state. the fix uses fallible allocs and a global please-return-early OOM flag but requires touching Everything. completeness is impossible 😰😰😰
- Oct 21, 2026, 4:15 PM
I hope you enjoyed my attempt to compress 1500 words about what I learned from skimming the patch into 280 characters, that was hellish, it's really hard not to sound like an LLM when you do this
- Oct 21, 2026, 4:16 PM
uncompressed version with too much text to fit in the alt text field, sorry
Oct 21, 2026, 6:21 PM@hikari the content does fit in an alt-text.
You're welcome.
Oct 21, 2026, 9:53 PM@hikari yikes 😬
Oct 21, 2026, 6:55 PM@hikari One thing PHP bashers have never quite realised is how much of it is quite a thin wrapper around C. Some functions even have the same names.
