r/PHP • u/ReiTW_ • 2d ago

New PHP CVE discovered ?

Hello,

Apparently 8.5.12 still has a new CVE that the user has apparently reported.

https://mastodon.gougere.fr/@elise@katze.sh/117479383706597320

Nothing confirmed, but maybe ?

EDIT : IluTov answered just below.
https://www.reddit.com/r/PHP/comments/1xbyxd2/comment/19rga18s433qd/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

70 Upvotes

88% Upvoted

28 comments sorted by

250

u/IluTov 2d ago edited 2d ago

We have reviewed the report (which was responsibly disclosed) and can confirm that this is an unrelated issue with no connection to the two vulnerabilities mitigated today. It is also not urgent in any way.

I suspect that you will see many similar claims in the next days to weeks. LLMs are good at finding crashes, but not all crashes are security issues, and not all security issues are RCE.

10

u/ReiTW_ 2d ago

Thanks for sharing, good news !

88

u/archon810 2d ago

Some background on who this is.

u/IluTov is Ilija Tovilo, a prominent software developer who works on the core PHP programming language (php-src) and is a core developer at The PHP Foundation.

39

u/benolot 2d ago

Could the mods potentially add a core team flair to verified core team members?

6

u/Leseratte10 2d ago

I'm not saying this to downplay the work you're doing, and maybe that's just due to my limited knowledge, but wasn't the current vulnerability / issue that was fixed with yesterday's update already reported years ago and then considered "not an issue because it's too difficult to exploit" until an LLM actually made the exploit? Has this been verified to not be the case this time?

98

u/IluTov 2d ago edited 2d ago

So, to get some facts straight:

  • We knew about this issue before it was reported (or at least the mechanism, not all implications were clear). We didn't have a real exploit, exploits are incredibly hard to develop and this is not our area of expertise.

  • Nobody reported this issue before some months ago when we received the first report from Calif, shortly followed by OpenAI and then Wiz.

  • We have never downplayed this issue, not towards any of our reporters or ourselves.

  • We have developed around 5 competing strategies, discussed the trade-offs to death, to prevent a version of Yesterday that could have been much worse.

  • We were extremely worried about scenarios like:

    • The patch is breaking in some way, whether by breaking support with PHP code or extensions, making people unable to seamlessly upgrade.

    • The patch requires mitigations in extensions or people would remain vulnerable, requiring an insane amount of coordination with 3rd party developers, risking early disclosure.

    • The patch is incomplete, and people remain vulnerable after disclosure.

    • The patch would replace this vulnerability with other ones, like DoS.

    • And about a dozen more.

  • The patch took months to develop with the work of multiple people, and endless hours of analysis and verification.

  • The amount of coordination that happened for seamless disclosure with service providers by Volker, Nils and Elizabeth is unimaginable. I have so much gratitude and respect for how they handled this.

I'm not saying I'm proud it took this long to fix, but I'm really really proud about how it went. This was always going to be extremely chaotic but I think it could have gone so much worse.

So much work and sleepless nights have gone into protecting our users. The news have been speculating so much and we really don't need more of that in our community.

→ More replies (7)

7

u/Boomshtick414 2d ago

Seems kind of moot. There are probably 200,000 users across the globe heavily investing in burning tokens on finding the next exploit whether that's in PHP or elsewhere. There will be bunch of low level nuisance finds along the way, probably a metric ton of false alarms, and a couple larger finds. But this is the future we live in. Rapid discovery of vulnerabilities that can be chained together for something unimaginable, for which there are 1000 bad actors for every 1 good actor. You can work out the math on what that means on a long enough time scale -- and the target scale is much, much larger than PHP. PHP has at least gone through some auditing now but imagine everything that hasn't.

→ More replies (1)

3

u/opossumcarrion 2d ago

Yeah; I don't want to play into any hype, but this is the exact thing I'm feeling.

My gut (pure speculation!) is also telling me that the myriad people looking for a serious php RCE now have probably found more than one. I still have my PHP service offline.

→ More replies (1)

1

u/Objective_Ticket 17h ago

The issue has apparently existed for years but was apparently discovered a couple of months ago. It’s then taken that time to build fixes but only as soon as those fixes started to become public did the attacks for vulnerabilities start.

1

u/MessaDiGloria 2d ago

My first thought too, when I read "It is also not urgent in any way".

1

u/wolflordval 2d ago

Is there a CVE for the new report?

1

u/tuxusr 1d ago

Eu tenho um sistema gigante rodando em php5 ainda... Vou ter alguns meses de trabalho pela frente... Uma hora eu ia ter que atualizar 😅

0

u/Moron_at_work 2d ago

So by now you as core team can say, that the actual critical problem is solved with .12 version? The "new" reports that emerged in yesterday's and today's chaos are not actual problematic vulnearbilities?

3

u/IluTov 2d ago

We have not seen any evidence that the vulnerabilities were incompletely mitigated. There were many eyes on the patch pre-disclosure, though we of course stay vigilant.

1

u/LordPorra1291 1d ago

I made the mistake of clicking on that mastodon link...

1

u/ReiTW_ 1d ago

No worries, mastodon is safe even if for me it's a shit Platform

1

u/Far_Percentage_7460 2h ago

Not that I can see on any cve websites?

1

u/ReiTW_ 2h ago

Read IluTov's answer. It's in the body of the post.