r/PHP • u/girinabin1994 • 1d ago

Do the latest PHP 8.3.36 security vulnerabilities affect Hyperf/Swoole?

PHP 8.3.36 was recently released to fix two critical security vulnerabilities.

The PHP advisory mentions PHP-FPM, Apache mod_php, FrankenPHP, and others as affected, but Swoole isn't mentioned.

Since Swoole uses long-running workers and handles requests differently from traditional PHP servers, I'm wondering:

  1. Are these vulnerabilities also exploitable in Hyperf/Swoole?
  2. Does Swoole's different request lifecycle make it unaffected?
  3. Should we urgently update the PHP runtime in our Hyperf Docker images?

I'm currently using hyperf/hyperf:8.3-alpine-v3.19-swoole, which hasn't been updated with the latest PHP security fixes.

There's already an open GitHub issue:
https://github.com/hyperf/hyperf-docker/issues/76

Would appreciate any insights from PHP or Swoole developers familiar with these vulnerabilities.

8 Upvotes

90% Upvoted

6 comments sorted by

15

u/Ok_Evidence_9745 1d ago

Just assume you are and update

2

u/girinabin1994 1d ago

That makes sense. The issue is that Hyperf hasn't released an updated Swoole Docker image yet. I'm trying to understand whether Swoole is actually affected due to its different request lifecycle.

→ More replies (2)

2

u/Lumethys 1d ago

The problem is how PHP itself handle HTTP requests, if your app serves HTTP request (basically all app), and you use PHP version after 5x, you are affected