It’s not a quick or easy fix. The patch is a 10000 line nightmare. No really it’s actually 10k. A lot of that is test code, but there are also significant changes to deep engine internals.
PHP did really really bad memory limit handling. Now it’s only really bad.
No, they chewed snots for years because there wasn’t a trivial and straightforward fix and exploit looked too “theoretically possible”. But some time ago(months? year?) some company showed them a working exploit, so they started to think how to actually fix the problem. All that time they kept all in secret so hackers wouldn’t know. But the fix had leaked, letting hackers to figure out what was the vulnerability in the first place, so snot-chewing was replaced with running-and-screaming. By now everything is fixed for those who cared to update\recompile. Something like that.
To add what the others said, yesterday morning there was news that every php version is vulnerable but the fixes were published very late in the day (or whenever depending on timezone) thus there was a 8+hours of unceartiny and fear for administrators. A lot of websites shut down due to that.
Why is everybody talking about PHP lately? Am I out of the loop?
They fixed a bunch of vulnerabilities there which were known for years but neither hackers nor PHP developers cared much until recently.
Wait it was known!? They didn’t just discover it and fixed it quickly?
It’s not a quick or easy fix. The patch is a 10000 line nightmare. No really it’s actually 10k. A lot of that is test code, but there are also significant changes to deep engine internals.
PHP did really really bad memory limit handling. Now it’s only really bad.
Wow scary fix, I’m guessing we’re going to be seeing a few new patches really soon fixing bugs created by this latest version
No, they chewed snots for years because there wasn’t a trivial and straightforward fix and exploit looked too “theoretically possible”. But some time ago(months? year?) some company showed them a working exploit, so they started to think how to actually fix the problem. All that time they kept all in secret so hackers wouldn’t know. But the fix had leaked, letting hackers to figure out what was the vulnerability in the first place, so snot-chewing was replaced with running-and-screaming. By now everything is fixed for those who cared to update\recompile. Something like that.
Thanks, makes sense!
To add what the others said, yesterday morning there was news that every php version is vulnerable but the fixes were published very late in the day (or whenever depending on timezone) thus there was a 8+hours of unceartiny and fear for administrators. A lot of websites shut down due to that.