I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796
Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?
Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn’t from reading news sites
According to the PHP Foundation the OOM vulnerability was originally found by the security audit they commissioned back in 2024.
They never fixed it because there was no working exploit at the time and also because all the fixes had important downsides and they went into decision paralysis.
I do believe that two years is plenty of time for someone to figure out a working exploit, especially with AI assists.
Bottom line, the timing of this recent debacle is centered around the moment that the PHP Foundation decided to finally eat crow, not around when the exploit was actually available. The embargo was just for spectacle. PHP circles are already spinning it as “see how important PHP is, how much of the internet runs on it, how it’s critical infrastructure”.