Upcoming Critical PHP Security Release

If you have a PHP site with anything sensitive, you should probably turn it off until you've installed tomorrow's patch. Last month on another project that quietly opened a PR with a patch saw exploit attempts less than 10 minutes after becoming public. With this level of severity and popularity, I would expect the PHP vulnerabilities will be re-discovered and put to use overnight.

I shut down all my web-facing (non-critical) PHP apps in anticipation.

Some predictions (pure guesses/speculation, I don't have any insider info):

• It's something in the JIT, that combined with a popular framework/application is exploitable by unathenticated users.
• Following on that, there's probably a php.ini flag or similar to easily disable the vulnerable functionality.
• It was found using an LLM. A human probably could've found it eventually, but most likely wouldn't have figured out how to exploit it.

Here's a (supposed) video of it in action: https://mastodon.social/@Viss/117475758985207443 Might not be a good idea to watch it if you have epilepsy, there are some annoying editing effects. I really appreciate the dancing anime girls, though!

Based on the breadth of targets presented, this probably doesn't require anything special from the web app. Exciting.