Looks like there might be a second vulnerability: https://fedi.katze.sh/@elise/117479383739450605

The patches are very dirty (thousands of `if (ZEND_HAS_OOM()) { .. return failure`); my first reaction is they've probably missed something.

▲

modeless 32 minutes ago | parent | prev | next [-]

There is now an iron clad defense against all memory safety bugs leading to RCE that is actually practical to use in production in many cases, and people should start taking it seriously. Any PHP install that has ~2x CPU headroom should be switched to a memory safe Fil-C build immediately. More generally, anyone running network-exposed C/C++ code that is not routinely pegging the CPU should recompile with Fil-C ASAP.

	▲	anonymous908213 5 minutes ago \| parent [-]
		"The entire world should use 2x more compute" is not a real answer. You can do that on your own personal computer which has compute to spare. For servers, you're already paying for the relevant amount of compute to serve your thousands or millions of users, and every % of overhead matters at that scale. You are suggesting everyone allocates a 2x budget for server-compute, or I suppose you're only talking about hobby servers where people are running tiny workloads and had so little traffic it doesn't matter?

▲

Maxion an hour ago | parent | prev [-]

Meow!