← Feed

Posts

• View post

  Not sure if it is just curiosity or OCD, but been spending the morning digging into php2shell trying to reproduce the RCE, since none of the ready-to-go versions I saw worked. So far, under controlled conditions with a few deviations from stock PHP config and a single process model using mod_php (PHP as Apache module) I am able to reliably trigger RCE on PHP 8.5.11 on stock Debian Trixie docker container. More in replies...

• View post

  pdo_duckdb 0.9.0, out today, bundles DuckDB 2.0.0, with opt-in lossless fetches for LIST, STRUCT, MAP and VARIANT, and a fix for lost writes between two connections to one file. This month I also ran a security scan across all ten of my PHP extensions plus nameparser, and each has a fix release: a heap overflow from a malicious ClickHouse server, an appender use-after-free, a nested allowed_classes bypass, a 16 KB name taking 17 s to parse. https://ilia.ws/blog/seventeen-seconds-to-parse-one-n...

• View post

  I wrote up the php2shell RCE (CVE-2026-109618 and CVE-2026-109619): the root cause, the signed-integer primitive, and the paths to a shell on both mod_php and FPM. Reliable exploitation is a lot harder than the headlines made it sound: every chain is pinned to one exact build, so the public PoCs mostly crash on a different one. https://ilia.ws/blog/php2shell-two-ways-php-corrupts-its-own-memory #php #security

• View post

  Nine of my PHP extensions shipped today, and almost none of it is new features. php_excel's local saves stream again instead of buffering the whole workbook: 67.7 MB peak RSS to 0.7 MB. pdo_duckdb re-latches its open_basedir sandbox per chunk instead of per row: 133 ns/row back to 51. phpser closed three use-after-frees, one reachable by anyone with the signing key. Most of the perf work paid back what the hardening cost. https://ilia.ws/blog/the-cost-of-failing-closed-what-shipped-ac...

• View post

  fastjson 0.9.0, the yyjson-backed alternative to ext/json, is mostly a memory release. fastjson_validate() now reads your buffer in place: constant peak like ext/json's streaming validator, ~30% fewer instructions. A 1 MiB escaped string encodes at a 59-83% lower peak. Key-heavy decodes peak ~15% lower; unique-key input pays 3-5%. 0.8.0 and 0.9.0 also stopped validate accepting [[],] and file_encode leaving silently truncated files. https://github.com/iliaal/fastjson/releases/tag/0.9....

• View post

  phpser 0.7.0, the decoder-optimized binary serializer for PHP caches: a 1000-object DTO batch now decodes 65% faster than igbinary, up from 51% at 0.5.0. A 1000-row rowset went from 21% to 53%. Nested arrays shared by pointer (an Eloquent model's attributes and original) now decode as one refcounted table, and decode adds one GC root per result instead of one per object. New wire tags: upgrade every cache reader before any writer. https://github.com/iliaal/phpser/releases/tag/0.7.0 #...

• View post

  Exactly right, and then trying to call themselves "labs" as if it absolves them of liability... They are all commercial, for profit companies and must be responsible for their products, just like other companies are.

• View post

  whetstone 5.1.1 fixes 20 findings (8 high, 6 medium, 6 correctness) that @edorian reported after scanning 5.1.0 through OpenAI's Daybreak Red security program. All were valid. A few were documented behavior and the model inflated some severities, but every one was worth fixing. Thank you, Volker. For context, whetstone is my skill repo and plugin for Codex and Claude Code. If you find a security issue in it, please report it privately: https://github.com/iliaal/whetstone/security/adviso...

• View post

  Genuinely enjoyed the article, a rare piece that covers both sides as opposed to picking one extreme. One section I think is a bit more nuanced is around energy, AI (datacenters) do use lots of power, but they are not dissimilar to a factory using widgets, which brings value. Solution seems like a way to focus on scaling power generation as opposed to imposing limits.

• View post

  A few times now had a run-away testsuite consume all memory, in part due to the fact on CLI, php runs without a memory limit by default. @sebastian@phpc.social Any thoughts about adding default limit (even a large on 1G) to phpunit by default?

• View post

  EU never fails to demonstrate "democracy" in action: https://www.patrick-breyer.de/en/eu-parliament-greenlights-chat-control-1-0-breyer-our-children-lose-out/ Somehow (314 against, 276 in favor, 17 abstentions), translates to motion passing...

• View post

  Been getting into PHP project dev lately with lots of fixes going in, but none of that would be possible without feedback & pr reviews from other core devs. Thank you for your often thankless work