The PHP2Shell fix, two weeks on: what the PHP-src issue tracker shows
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
The PHP2Shell fix, shipped October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, makes memory_limit soft and adds a hard limit, by default 200% of it, that ends the process with exit 137. AI News Report found eight php-src issues naming the fix commit, four of them behavior regressions. In its test, a sprintf call that once gave a fatal error now exits 137; four fix PRs for that case were open. Several figures, including the commit size and the crash-queue statistics, could not be independently checked.