How PHP-on-WASM sandboxing blocks host escapes: deny-by-default capabilities explained
MickeySteamboat · x · 2026-10-21
Developer MickeySteamboat details his PHP WASM server security architecture: WebAssembly's linear memory and capability-based model (deny-by-default for filesystem, network, and other host resources) prevents classic host-level escapes affecting native PHP. Strict authentication gates the runtime, and even a successful memory-corruption RCE inside the WASM module is limited to imported host functions. He also bans Rust and custom npm crates to shrink the attack surface.
Related event: Researchers Debate Whether WASM Sandboxes Truly Prevent RCE(3 posts)→
More from Infra
- Micron Webinar: Bet on Bit Growth, Not History, for Memory Demand — BenBajarin · 2026-10-21
- JPMorgan doubles SpaceX price target to $500 as it adds ~200K GPUs per month — mitchdeg · 2026-10-21
- TorchTPU Brings Native TPU Support to the Hugging Face Ecosystem — rseroter · 2026-10-21
- CoreWeave launches Physical AI Launchables: run robotics and simulation workloads with one command — ayushthakur0 · 2026-10-21
- NVIDIA locks up massive ABF substrate capacity again, cementing its win in the AI compute cycle — BenBajarin · 2026-10-21
- php2shell Flaws Hit ~70% of Websites; Cloudflare Shipped WAF Rules 9 Hours Early — Cloudflare Blog · 2026-10-21