Comment by smusamashah
6 hours ago
Someone is saying there is a new vulnerability that works on the newest 8.5.12 https://x.com/_annieversary/status/2112933589943742598
6 hours ago
Someone is saying there is a new vulnerability that works on the newest 8.5.12 https://x.com/_annieversary/status/2112933589943742598
That partial stack trace linked above seems to match this GitHub issue, which has much more information: https://github.com/php/php-src/issues/24488 (double-free introduced in 8.5.12)
From what I can see, this causes a crash only, and isn't weaponisable. It's a use-after-free, but the reclaim window is zero by construction.
[dead]
Mr. President...
... a second feline has hit the stack.
Is there anywhere good to get some sort of reliable stream of information about this possibility?
It's going to be pretty bad if we all panic to get the latest PHP up, and all confidently roll out our updated websites, just for them to still be vulnerable to something serious anyhow.
This is why I like to have a minimum age requirement on package releases. Something like at least 2 or 3 days.
To be clear they said it “still works” and “ ok thinking more about this, there's no way this is the same vuln, this is another one.”
Meaning this specific bug the parent comment is talking about is not new in just these patched versions from today.
So delaying your updates today would mean you’re exposed to an actively exploited RCE and still exposed to the other memory corruption bug (which may or may not be an easily exploitable RCE) for an entire 2 or 3 days.
And from the sounds of it people are very actively exploiting this so waiting 24+ hours will practically ensure you’re hit.
lol this is the exact scenario where that’s an well idea. Maybe the patch is bad, but not patching for 2 days means your guarantees to be hit by the original issue
We are damned if we don’t and (often times) damned if we do
Anymore on this, I'm upgrading to 8.5.12 now and don't want to still be vulnerable?
[flagged]
Thank you very much.
This needs to be said, and this language cannot be saved.
Some web apps require it still. So that's not an option.
4 replies →