PHP 8.5.12 security patch incomplete: three exploit paths survive, lab-confirmed
jedisct1 · x · 2026-10-22
A security researcher shared lab-verified findings that the PHP 8.5.12 security patch is incomplete — three exploit paths survive on the patched version.
- vardestroy destructor-reentry UAF (confirmed, boundary unchanged): 3/3 ASAN samples reproduce on 8.5.12; the patch added fallible allocations and ZENDHASOOM guards but no BC(serializelock) around destruct dispatch — a memory-safety bug surviving a patch meant to fix memory-safety bugs
- Handler mismatch (confirmed): phpserialize-written path remains
- Upload-progress key injection (confirmed): attacker data stored verbatim in session files; requires an app-level LFI/include sink
Both CVEs are fixed, but the attack surface is not — the finding should be reported to the PHP security team as a follow-up.
Related event: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2 posts)→
More from Safety
- Aaron Levie: AI agents will reshape cybersecurity, burning 100X more tokens than expected — brucemacv · 2026-10-22
- PHP Foundation says Chainguard broke security embargo ahead of emergency RCE patches — jedisct1 · 2026-10-22
- US states restrict retinal images as PII, threatening medical AI research — pearsekeane · 2026-10-22
- Generator Residency pays $8,500/month for a 3-month AI safety program in Berkeley — alexcovo_eth · 2026-10-22
- GoDaddy revokes 404,607 TLS certificates after mismatch flagged; 177k still pending — natesiggard · 2026-10-22
- Former FTC Chair Lina Khan calls today's AI exceptionalism "ludicrous" in AI governance talk — AINowInstitute · 2026-10-22