PHP Internals ([RFC]/[VOTE]) · September 29, 2026curated by Sönke
Sjoerd Langkemper has proposed the PHP RFC bcrypt_max_password_length. It would make password_hash() throw ValueError when bcrypt receives input longer than 72 bytes. PHP currently truncates longer input silently, hashing only the first 72 bytes. The change targets severe security vulnerabilities, especially in applications that hash data beyond a user’s password.
Sjoerd Langkemper has drafted the PHP RFC bcrypt_max_password_length. It proposes that password_hash() throw ValueError when bcrypt receives a password longer than 72 bytes.
PHP currently truncates longer input without warning and hashes only the first 72 bytes. The proposal aims to prevent severe security vulnerabilities caused by this behavior. It would primarily affect applications that pass data other than the user’s password to password_hash().
Since the earlier bcrypt report, the discussion has expanded to a possible change of the default algorithm, while PHP 8.6.0RC2 becomes the first relea…
Sjoerd Langkemper has proposed PASSWORD_BCRYPT_SHA256 for PHP’s password_hash() and password_verify(). Existing bcrypt can mishandle null bytes and ig…
Symfony 8.2 is scheduled for November 2026 and will require PHP 8.4 or newer. The development branch adds component-owned bundles, recent-authenticati…
Check Point broke six agent frameworks eleven times in one year, and almost none of it was novel: deserialized state, SQL injection, unauthenticated e…
Comments
No comments yet — be the first.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.