a_gee_dizzle@lemmy.ca to No Stupid Questions@lemmy.world · 1 day agoWhat's going on with PHP?message-squaremessage-square58linkfedilinkarrow-up1100arrow-down13file-text
arrow-up197arrow-down1message-squareWhat's going on with PHP?a_gee_dizzle@lemmy.ca to No Stupid Questions@lemmy.world · 1 day agomessage-square58linkfedilinkfile-text
A lot of people in techny internet spaces online are talking about a PHP embargo. What does that mean and what’s going on?
minus-squarecman6@lemmy.worldlinkfedilinkarrow-up16·edit-222 hours agoJust to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo. That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug. Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
minus-squaresomehacker@lemmy.worldlinkfedilinkEnglisharrow-up14·22 hours agoChainguard claims they had evidence of exploits being used in the wild. If that’s true breaking the embargo was the correct move. The embargo is only useful if the exploit isn’t in the wild.
Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.
That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.
Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Chainguard claims they had evidence of exploits being used in the wild. If that’s true breaking the embargo was the correct move. The embargo is only useful if the exploit isn’t in the wild.