that PHP fix is 13k lines
5k apparently of non-tests
that's all human written, right? I wouldn't want to speak out of turn about sprawling quick fix diffs
1 Boost
0 Likes
The fix for EOL versions are ~300 lines.
- 7.4: https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2
- 8.0: https://github.com/php/php-src/commit/82f8f31b16a035c1b67cc253e79f7cc288f4cc20
- 8.1: https://github.com/php/php-src/commit/1d7dec178a094e6e75b229ce22754045f8c6070a
@davidgerard According to this page:
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
they were informed of one of the vulnerabilities in 2024, and wasted much of the intervening time arguing about how to fix it. So I'm not sure this one qualifies as "quick fix".
(Still glad to not be running any PHP on anything I manage...)
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
they were informed of one of the vulnerabilities in 2024, and wasted much of the intervening time arguing about how to fix it. So I'm not sure this one qualifies as "quick fix".
(Still glad to not be running any PHP on anything I manage...)
@corbet i just spent my entire day and missed doing today's post/episode because of it, so i'm not enamoured of PHP
i expect the PHP team is not having the greatest day either
@davidgerard according to the blog post that went with this security release, they've been working on this patch for about 2 MONTHS, so this gigapatch may very well likely be human
@davidgerard php team busy at work
@stoori i expect they're not having the greatest day either
@davidgerard Even if this isn't that, at *some* point we're going to see a quick "everyone panic! Keystone tool XYZ is compromised!" 13kloc fix that fixes … something … then deliberately adds three more well-obfuscated backdoors.
@cstross if we haven't seen it yet we haven't noticed it
vibe code is a playground for the bad guys
@davidgerard We've spent more than 75 years trying to keep code and data separate and vibe coding just drunk-drove a bulldozer through a lifetime of hard-learned lessons about best practices.
@cstross @davidgerard Everyone knows the solution to in-band signaling is more in-band signaling with a lid of extra begging and pleading on top.
![[object Object]](https://media.mas.to/accounts/avatars/109/287/758/133/964/366/original/0f3099c0adfb36a0.png "[object Object]")
@davidgerard just a quick 13kloc fix for my personal homepage tools
@davidgerard It doesn't look LLM generated at first blush, but I'm no longer confident in my ability to tell to be honest. Either way, you could not possibly pay me enough to sign off on +11k -1k over 423 files with most of it being random branches and gotos...