Comment by randomblock1

9 hours ago

Inert files are unrealistic, normally you use PHP server to execute PHP code, which this website doesn't appear to do (only static files). And suppose you want to accept >1mb file uploads, that limit would get in your way. So it's not a good representation of a PHP application, but for other uses it's reasonable.

4 comments

randomblock1

Reply
weird-eye-issue  5 hours ago

So why did the original warning put out by the PHP team say that the exploit didn't rely on the application code and simply having software like Apache mod_php running would be enough?

https://www.php.net/archive/2026.php#2026-10-21-5

  • randomblock1  2 hours ago

    You can still trigger DoS. And these can be chained with other vulnerabilites. The expectation of a PHP server executing PHP code also could have been implied.

    • FredFS456  1 hour ago

      DoS is independent of the vulns though. From what I understand, you can craft a request of x size which consumes ~200x the memory on the server. Parallelize that and you can DoS servers with only a few GB of memory, even with the 1MiB Nginx limit.