I sat down with Volker Dusch for the Laravel Creator Series to talk about this week's critical PHP security releases. Volker works at Tideways and is currently the AI Security Engineer in Residence on the PHP Foundation's Ecosystem Security Team, and he worked with the PHP security team on these fixes.
We covered how the two vulnerabilities were reported, why a PHP fix takes longer to reach your server than a browser update, the embargo that got broken, and what the PHP Foundation is taking away from it.
How the Vulnerabilities Were Found
The PHP Foundation got PHP into OpenAI's Patch the Planet program, and the security firm Calif started an audit of PHP as part of it. Not long after, Calif emailed Volker asking to meet urgently. They had a minimal exploit running in a Docker container, and once the PHP security team saw it, everyone agreed it was real. OpenAI and Wiz reported more attack vectors with the same root cause.
Why the Fix Took Coordination
Volker explained that the PHP project ships source code, not the PHP you install. The fix has to go through Debian, Ubuntu, Red Hat, the official Docker Hub images, and the images built on top of those. Because of the severity, the team also helped coordinate backports for versions PHP no longer supports, and OpenAI and Wiz reached out to the large cloud hosts the team didn't have direct contacts with.
The team also worked with web application firewall vendors such as Cloudflare so they could ship rules before release day, which protects sites that don't patch right away.
The Broken Embargo
Distributors got the patch early so their users could update the moment the vulnerabilities went public. Chainguard broke that embargo and published patched images more than six hours before the coordinated release. Volker pointed out that anyone can now turn a patch, or even a binary, into an exploit much faster than before:
It is a rough sell to say you're working on security if you leave most of the people exposed.
Fake Proofs of Concept
We also talked about the exploit screenshots going around social media. Volker said several of the ones he checked only worked against a Docker container that had been specially modified, and did nothing against the default image from Docker Hub.
The folks that we work with know how to use AI as a tool to make themselves better and not to just offload your thinking to the machine.
The Session Upload Progress Advisory
PHP published a follow-up advisory today that recommends setting session.upload_progress.enabled=0
until the next regular bugfix release. That setting was already one of the mitigations in Wednesday's advisory, so if you applied it then, you don't need to do anything else. Volker said the conditions for this one are very particular and it's minor in comparison.
Who Did the Work
Volker made a point of crediting Ilija, Arnaud, and Jakub, who spent their days and nights in PHP's C code while he handled communication. Because the bug pattern could show up in many places, missing a single one would have meant another release:
We have to fix every place where this happens. Every place means if we miss one it's a problem.
Those developers are paid full time by the PHP Foundation, which is why the team could drop everything else for this. If your company builds on PHP, Volker asks you to consider sponsoring the Foundation:
If you make a ton of money off of building apps on top of PHP, giving back just a tiny fraction of that is very useful.
Give the video a watch, and a big thanks to Volker for making time for this in such a busy week!