Hacker GitHub

← All repos

php/php-src

View on GitHub ↗ ★ 41,753 C

The PHP Interpreter

124 mentions on Hacker News by 101 people: 28 stories, 96 comments · first 2009-07-24 · latest 2026-10-29

Mentions per year 124 mentions · busiest year 2026 (21)
20082026
AllStoriesComments NewestTopOldest
  1. I'd suggest reading https://github.com/php/php-src/blob/master/php.ini-productio... , then doing a web search for "editing php.ini for maximum security". Maybe compare with https://github.com/php/php-src/blob/master/php.ini-developme... ,…
    comment by bell-cot · 2026-10-29 · in Chained PHP2Shell exploit roots 25 servers, including US Government servers
  2. …7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-...
    comment by account42 · 2026-10-22 · in PHP 8.2.35
  3. That post appears to show the same stack trace as this reported issue https://github.com/php/php-src/issues/24488 , which is a confirmed GC regression in 8.5.12 but it is not exploitable (the allocator's shadow protection kills it), and it…
    comment by nr378 · 2026-10-21 · in Potential third critical PHP CVE
  4. …partial stack trace linked above seems to match this GitHub issue, which has much more information: https://github.com/php/php-src/issues/24488 (double-free introduced in 8.5.12) From what I can see, this causes a crash only, and isn't…
    comment by nr378 · 2026-10-21 · in PHP 8.2.35
  5. ▲ 7
    The PHP fix for CVE-2026-109618 and CVE-2026-109619: +11556 lines of code
    story by TekMol · 2026-10-21 · 4 comments
  6. …of what the proxy is trying to do. https://github.com/Qbix/proxy/blob/main/src/sanitize.c#L41 https://github.com/php/php-src/blob/master/main/SAPI.c#L162 The article linked from your own README ( https://sansec.io/research/php2shell ) has…
    comment by mirashii · 2026-10-21 · in PHP 8.2.35
  7. …fix seems to disable session upload entire in old version, not fixing the issue like new versions: https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4...
    comment by airtnp · 2026-10-21 · in PHP2Shell: AI uncovers critical RCE in PHP
  8. …in a way different from a standard-compliant implementation (such as web server, WAF etc). [1] https://github.com/php/php-src/blob/master/main/rfc1867.c#L7...
    comment by codedokode · 2026-10-21 · in Security advisory: Critical remote code execution vulnerabilities, update now
  9. …missed sales, potential data leaks and hacks) of the way that this was handled is significant. [1] https://github.com/php/php-src/security/advisories/GHSA-6wmf...
    comment by esquire_900 · 2026-10-21 · in PHP 8.2.35
  10. Check the tags: https://github.com/php/php-src/tags
    comment by petecooper · 2026-10-21 · in PHP 8.2.35
  11. ▲ 3
    PHP RCE via OOM Corruption
    story by pranshuchittora · 2026-10-21 · 2 comments
  12. ▲ 2
    PHP RCE via stale global state
    story by pranshuchittora · 2026-10-21 · 0 comments
  13. …of all days it would genuinely give me pause for caution. edit: yeah, really not feeling that: https://github.com/php/php-src/compare/php-8.2.34..php-8.2.3... Hopefully just a mistake? But looks like a botched release at the least
    comment by ytxm · 2026-10-21 · in PHP 8.2.35
  14. https://github.com/php/php-src/commit/01a40e89fbfc499936e3b0... What everyone is looking for.
    comment by charcircuit · 2026-10-21 · in PHP 8.2.35
  15. Advisories with the details are public: https://github.com/php/php-src/security/advisories/GHSA-w8hw... https://github.com/php/php-src/security/advisories/GHSA-6wmf...
    comment by tux3 · 2026-10-21 · in PHP 8.2.35
  16. …full technical details: https://www.php.net/archive/2026.php#2026-10-21-5 RCE via OOM corruption - https://github.com/php/php-src/security/advisories/GHSA-w8hw... RCE via stale global state - https://github.com/php/php-src/security/advisori…
    comment by nr378 · 2026-10-21 · in Security advisory: Critical remote code execution vulnerabilities, update now
  17. ▲ 1,107
    PHP 8.2.35
    story by tuyuri · 2026-10-21 · 581 comments
  18. …needing to ssh into 100k+ machines on support rotation & never having emacs on any of them. [1] - https://github.com/php/php-src/blob/master/.gdbinit
    comment by gopalv · 2026-09-11 · in Show HN: Toast, a by default in-terminal IDE
  19. …your question, probably not. I dated the PHP change that added this "optimization" back to 2014 ( https://github.com/php/php-src/commit/b547e1358d3846fad4cd0c... ), while DynAsm only started being used around 2019 (…
    comment by purplesyringa · 2026-07-23 · in Log is non-monotonic in PHP and Lua
  20. ▲ 1
    Master branch PHP now BSD 3 Clause
    story by sidkshatriya · 2026-04-16 · 1 comment
  21. ▲ 3
    Reified Generics in PHP
    story by mastabadtomm · 2026-02-28 · 0 comments
  22. …hashset regardless of input. Edit: found an example which does different things depending on input https://github.com/php/php-src/blob/master/ext/standard/arra... This does the usual hashset based approach only if the array has strings.…
    comment by porridgeraisin · 2025-03-12 · in What makes code hard to read: Visual patterns of complexity (2023)
  23. …you have to check how php populates the $_COOKIE superglobal I think it is somewhere is this file: https://github.com/php/php-src/blob/master/main/php_variable...
    comment by arkh · 2024-11-22 · in Handling cookies is a minefield
  24. Tagged release on GitHub: https://github.com/php/php-src/releases/tag/php-8.4.0 Downloads on php.net expected on Nov 21, 2024.
    comment by petecooper · 2024-11-19 · in PHP 8.4.0
  25. …cool! If anybody is interested in looking at the bugs that were found, they can be found on Github: https://github.com/php/php-src/issues?q=author%3AYuanchengJi... If you work with some interpreted language that is written in C or C++, it…
    comment by mmsc · 2024-11-17 · in Fuzzing the PHP Interpreter via Dataflow Fusion
  26. …the person who added this code to PHP[1][2]. [1]: https://stackoverflow.com/a/8194500/2805120 [2]: https://github.com/php/php-src/blob/master/ext/session/sessi...
    comment by jkrejcha · 2024-08-14 · in Tell HN: Server error (5xx) in Google Search Console may not be 5xx at all
  27. …racker.ietf.org/doc/html/rfc6979#section-3.2 But you can also see this technique in CSPRNG code; i.e. https://github.com/php/php-src/blob/d40726670fd2915dcd807673...
    comment by some_furry · 2024-04-15 · in PuTTY vulnerability vuln-p521-bias
  28. …by default on FreeBSD - my PR is pending, and the patch has been in testing in ports for a while: https://github.com/php/php-src/pull/12288
    comment by Freaky · 2023-11-24 · in PHP 8.3
  29. I guess there will be one last release towards Nov 23, because I'm already seeing some activity ( https://github.com/php/php-src/commits/PHP-8.1/ ).
    comment by Ayesh · 2023-10-28 · in PHP 8.1.25
  30. ▲ 3
    A new PHP JIT implementation based on IR JIT framework
    story by mariuz · 2023-09-14 · 0 comments
  31. …But the old implementation had pointers to next and last (previous) element in the list: https://github.com/php/php-src/blob/PHP-5.3/Zend/zend_hash.h...
    comment by johannes1234321 · 2023-08-21 · in Ruby's hash is a Swiss-army knife
  32. …is: https://github.com/org/repo/tags.atom https://github.com/org/repo/releases.atom For example: https://github.com/php/php-src/tags.atom https://github.com/textpattern/textpattern/releases.atom Chuck a bunch of those into your reader of…
    comment by petecooper · 2023-06-20 · in Style your RSS feed
  33. Yes, fixed in all (at the time) supported versions in October last year [0]. [0]: https://github.com/php/php-src/commit/248f647
    comment by tomudding · 2023-03-07 · in A Vulnerability in Implementations of SHA-3, Shake, EdDSA
  34. The GitHub advisory is a better location to point this submission to: https://github.com/php/php-src/security/advisories/GHSA-7fj2...
    comment by captn3m0 · 2023-02-23 · in PHP bug: Password_verify() always return true with some hash
  35. More info: https://github.com/php/php-src/security/advisories/GHSA-7fj2... seems to be caused by a strange non-std php-specific crypto implementation
    comment by mjburgess · 2023-02-23 · in PHP bug: Password_verify() always return true with some hash
  36. Looking at the forked PHP source https://github.com/php/php-src/compare/master...dunglas:php-... I do not expect compatibility issues.
    comment by chx · 2022-10-14 · in Show HN: FrankenPHP, an app server for PHP written in Go
  37. ▲ 4
    PHP 8.2 Upgrade Notes
    story by RadixDLT · 2022-10-03 · 0 comments
  38. Belief isn’t required: https://github.com/php/php-src/blob/master/php.ini-productio... I suspect many people don’t RTFM or have any idea what they are doing with php (or js) because they are historically “entry-level” languages.
    comment by withinboredom · 2022-09-04 · in Myths About CGI Scalability
  39. …through everything in the file and often end up learning new stuff! For those who've never seen it: https://github.com/php/php-src/blob/master/php.ini-productio...
    comment by notRobot · 2022-09-03 · in Ask HN: What is the best config file documentation you have seen?
  40. Here's the latest optimization to that func: https://github.com/php/php-src/commit/085b360abb622abc18b955... In the latest addendum on the blog post, I ended up removing the counting of 1s.
    comment by withinboredom · 2022-03-18 · in Yes, PHP is faster than C#
  41. …://www.morling.dev/blog/fizzbuzz-simd-style/ ): - PHP isn't optimized anywhere , but at least it's C: https://github.com/php/php-src/blob/1c0e613cf1a24cdc159861e4... - Python's C implementation is the same:…
    comment by mschuster91 · 2021-12-16 · in Leveraging SIMD: Splitting CSV Files at 3Gb/S
  42. …https://www.php.net/manual/en/function.password-hash.php ) and then there's also the source code: https://github.com/php/php-src/blob/bf92bddb878dbd86d23db290...
    comment by al2o3cr · 2021-10-30 · in Ask HN: What is the default password hash algorithm for Wordpress?
  43. …that without using a GIL, instead it internally uses something called Thread-Safe Resource Manager https://github.com/php/php-src/tree/master/TSRM I have written about this recently https://news.ycombinator.com/item?id=28692014
    comment by tored · 2021-10-18 · in Python stands to lose its GIL, and gain a lot of speed
  44. ▲ 1
    Let zend_fiber and amphp have fun
    story by unclet · 2021-06-04 · 0 comments
  45. ▲ 2
    Implement Fibers in PHP
    story by velmu · 2021-04-26 · 0 comments
  46. …of the commits aren't signed. So no, this would probably not work for identifying everyone. [0] https://github.com/php/php-src/commits/master
    comment by Sebb767 · 2021-03-29 · in PHP's Git server compromised, moving to GitHub
  47. ▲ 1
    Backdoored Code in PHP Repository (reverted)
    story by lknik · 2021-03-29 · 1 comment
  48. …that they've had access since 2017? [1] Maybe they just wanted to burn it now for some reason. [1] https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad...
    comment by Ndymium · 2021-03-29 · in PHP's Git server compromised, moving to GitHub
  49. …be in their interest for the exploit to actually go through. [0] https://www.zerodium.com/ [1] https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad... [2] https://bugs.php.net/bug.php?id=78224 (only mention I found with a…
    comment by Sebb767 · 2021-03-29 · in PHP's Git server compromised, moving to GitHub
  50. …structures containing circular references. (I was involved in the development of this function: https://github.com/php/php-src/pull/4886 )
    comment by duskwuff · 2021-01-30 · in What's New in PHP 8.1