Report points to an unpatched PHP double-free issue
An October 21 post describes a reportedly separate PHP vulnerability that produces an AddressSanitizer double-free error in PHP 8.4.25. The author says the behavior was confirmed on PHP 8.5.10 and still worked on 8.5.12. The issue has reportedly been reported, and a short proof of concept reportedly exists. Technical details, a CVE and a patch are not public.
Comments
No comments yet — be the first.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.