PHP 8.5.12 patch may be incomplete, researchers
A post on X says the security fix may be incomplete but needs further validation. PHP says 8.5.12 fixes two critical vulnerabilities; no public confirmation establishes that the alleged remaining paths are exploitable.
By Ryan Merket · Published · Updated
Primary source: katze.sh
Why it matters
A double-free crash in a newly released PHP version merits investigation, but a local CLI abort does not prove remote exploitability or show that PHP's two critical fixes failed. Operators should distinguish Boyd's report from the patched advisories.
Elise Boyd reported a double-free crash in PHP 8.5.12 on October 21st, the day PHP released security updates for two critical remote-code-execution vulnerabilities. Her Mastodon post shows a locally built PHP command-line binary aborting during a proof-of-concept run. The screenshot establishes a crash in that test setup; it does not establish remote exploitability or show that either newly patched vulnerability remains exploitable.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.