PHP’s encrypted stream wrappers did not verify certificates. file_get_contents(‘https://…’) on 5.5 opened the connection, negotiated TLS and never checked who was on the other end, which made every…
A plugin that fetches a feed URL entered by a user is a server-side request forgery waiting to happen: the URL can be http://127.0.0.1:11211/, or the private address…
A query answering in 20 ms locally and timing out on four million rows. An anonymised data subset that keeps the query plan honest, and the mail, cron…
The OpenSSL bug published on 7 April lets a remote client read 64KB of the server process’s memory per request, repeatedly, leaving nothing in any log. Upgrading the…
5.3 stops getting security fixes in August. Deprecations first, then the behaviour changes, then the version bump — and an APC replacement that ignores every setting you tuned.
Three developers, three PHP patch versions and a bug that existed on one of them. A Vagrantfile, a playbook for everything inside it, and what the rebuild costs.