Blog
Notes from the engine room
What I found, what I fixed, and what I could not prove. Mostly CVEs and runtime internals.
- What the PHP2Shell rumors got wrong, from inside the PHP security team The PHP2Shell leak got the severity right and most details wrong: an out-of-memory error turned into RCE, and the real stopgap went unmentioned.
- CVE-2026-91768: FastCGI allowed_clients compared only 96 of an IPv6 address's 128 bits php-fpm accepted FastCGI connections from any address sharing the first 96 bits of an allowed IPv6 address, because one memcmp asked for 12 bytes instead of 16.
- CVE-2026-91766: PHP had the redirect credential leak curl fixed in 2018 PHP's http:// stream wrapper sent Authorization, Cookie and Proxy-Authorization to any host a redirect pointed at, the bug curl fixed in 2018.
- CVE-2026-45756: attacker-controlled regex in Symfony JsonPath filters (ReDoS) A JSONPath filter taken from a query string lets an attacker pick the regex a Symfony app runs, once per node in the document.