HNHacker News
TopNewBestAskShowJobs

throwaway800BC

4 karma · joined July 28, 2026

submissionscomments
throwaway800BC··on PHP2Shell: Exploitation attempts and remediation trends
Awesome that you looked into this!

Have you been able to run any benchmarks? (Are there any benchmarks for this kind of thing?) IDK, seems kind of silly when talking about PHP and webservers but people were concerned when I suggested it in the original thread.

In particular, it is mentioned that the `Zend` allocator does not play well with fine-grained tracking (so would not have caught this issue?) and you need to swap to the system allocator.

throwaway800BC··on Upcoming critical PHP security release (CVE-2026-109618 / -109619)
Took a quick peak at the relevant C code and what I think are the offending lines seem somewhat suspicious right off the bat.

Fil-C should have caught this right? I wonder if it would benefit the PHP ecosystem as a whole if the releases are built with it instead.