From RuntimeWire · RuntimeWire · · 40s
PHP 8.5.12 Patch May Be Incomplete
Researchers warn PHP 8.5.12 security patch might not fully fix critical vulnerabilities.
In brief
Researchers warn PHP 8.5.12 security patch might not fully fix critical vulnerabilities. Elise Boyd reported a double-free crash in PHP 8.5.12 that does not prove remote exploitability of newly patched vulnerabilities. Originally reported by RuntimeWire.
Elise Boyd reports PHP crash
Elise Boyd reported a double-free crash in PHP 8.5.12 on October 21st.
“Elise Boyd reported a double-free crash in PHP 8.5.12 on October 21st”
Local CLI crash not remote exploit
Her Mastodon post shows a locally built PHP command-line binary aborting during proof-of-concept run.
Patch may not fully address issues
The crash does not prove remote exploitability or show that PHP's two critical fixes failed.
The key point
Elise Boyd reported a double-free crash in PHP 8.5.12 that does not prove remote exploitability of newly patched vulnerabilities.
