It’s not a quick or easy fix. The patch is a 10000 line nightmare. No really it’s actually 10k. A lot of that is test code, but there are also significant changes to deep engine internals.
PHP did really really bad memory limit handling. Now it’s only really bad.
No, they chewed snots for years because there wasn’t a trivial and straightforward fix and exploit looked too “theoretically possible”. But some time ago(months? year?) some company showed them a working exploit, so they started to think how to actually fix the problem. All that time they kept all in secret so hackers wouldn’t know. But the fix had leaked, letting hackers to figure out what was the vulnerability in the first place, so snot-chewing was replaced with running-and-screaming. By now everything is fixed for those who cared to update\recompile. Something like that.
They fixed a bunch of vulnerabilities there which were known for years but neither hackers nor PHP developers cared much until recently.
Wait it was known!? They didn’t just discover it and fixed it quickly?
It’s not a quick or easy fix. The patch is a 10000 line nightmare. No really it’s actually 10k. A lot of that is test code, but there are also significant changes to deep engine internals.
PHP did really really bad memory limit handling. Now it’s only really bad.
Wow scary fix, I’m guessing we’re going to be seeing a few new patches really soon fixing bugs created by this latest version
No, they chewed snots for years because there wasn’t a trivial and straightforward fix and exploit looked too “theoretically possible”. But some time ago(months? year?) some company showed them a working exploit, so they started to think how to actually fix the problem. All that time they kept all in secret so hackers wouldn’t know. But the fix had leaked, letting hackers to figure out what was the vulnerability in the first place, so snot-chewing was replaced with running-and-screaming. By now everything is fixed for those who cared to update\recompile. Something like that.
Thanks, makes sense!