PHP Internals ([RFC]/[VOTE]) · September 29, 2026curated by Sönke
Sjoerd Langkemper has proposed the PHP RFC bcrypt_max_password_length. It would make password_hash() throw ValueError when bcrypt receives input longer than 72 bytes. PHP currently truncates longer input silently, hashing only the first 72 bytes. The change targets severe security vulnerabilities, especially in applications that hash data beyond a user’s password.
Sjoerd Langkemper has drafted the PHP RFC bcrypt_max_password_length. It proposes that password_hash() throw ValueError when bcrypt receives a password longer than 72 bytes.
PHP currently truncates longer input without warning and hashes only the first 72 bytes. The proposal aims to prevent severe security vulnerabilities caused by this behavior. It would primarily affect applications that pass data other than the user’s password to password_hash().
WordPress 7.1.2 patches CVE-2026-87902, a critical template-inclusion flaw around get_page_template(). The exploit only fires when theme layout, pearc…
An r/PHP post points to CVE-2026-91766 and associates it with a credential leak during HTTP redirects in PHP. The headline also notes that curl addres…
Check Point broke six agent frameworks eleven times in one year, and almost none of it was novel: deserialized state, SQL injection, unauthenticated e…
Anthropic split their agent monolith into brain, hands, and memory, cut p95 time-to-first-token by over 90 percent, and killed a credential-theft atta…
Comments
No comments yet — be the first.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.