Hacker GitHub

← All repos

php/php-src

View on GitHub ↗ ★ 41,753 C

The PHP Interpreter

124 mentions on Hacker News by 101 people: 28 stories, 96 comments · first 2009-07-24 · latest 2026-10-29

Mentions per year 124 mentions · busiest year 2026 (21)
20082026
AllStoriesComments NewestTopOldest
  1. I'd suggest reading https://github.com/php/php-src/blob/master/php.ini-productio... , then doing a web search for "editing php.ini for maximum security". Maybe compare with https://github.com/php/php-src/blob/master/php.ini-developme... ,…
    comment by bell-cot · 2026-10-29 · in Chained PHP2Shell exploit roots 25 servers, including US Government servers
  2. …7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-...
    comment by account42 · 2026-10-22 · in PHP 8.2.35
  3. That post appears to show the same stack trace as this reported issue https://github.com/php/php-src/issues/24488 , which is a confirmed GC regression in 8.5.12 but it is not exploitable (the allocator's shadow protection kills it), and it…
    comment by nr378 · 2026-10-21 · in Potential third critical PHP CVE
  4. …partial stack trace linked above seems to match this GitHub issue, which has much more information: https://github.com/php/php-src/issues/24488 (double-free introduced in 8.5.12) From what I can see, this causes a crash only, and isn't…
    comment by nr378 · 2026-10-21 · in PHP 8.2.35
  5. …of what the proxy is trying to do. https://github.com/Qbix/proxy/blob/main/src/sanitize.c#L41 https://github.com/php/php-src/blob/master/main/SAPI.c#L162 The article linked from your own README ( https://sansec.io/research/php2shell ) has…
    comment by mirashii · 2026-10-21 · in PHP 8.2.35
  6. …fix seems to disable session upload entire in old version, not fixing the issue like new versions: https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4...
    comment by airtnp · 2026-10-21 · in PHP2Shell: AI uncovers critical RCE in PHP
  7. …in a way different from a standard-compliant implementation (such as web server, WAF etc). [1] https://github.com/php/php-src/blob/master/main/rfc1867.c#L7...
    comment by codedokode · 2026-10-21 · in Security advisory: Critical remote code execution vulnerabilities, update now
  8. …missed sales, potential data leaks and hacks) of the way that this was handled is significant. [1] https://github.com/php/php-src/security/advisories/GHSA-6wmf...
    comment by esquire_900 · 2026-10-21 · in PHP 8.2.35
  9. Check the tags: https://github.com/php/php-src/tags
    comment by petecooper · 2026-10-21 · in PHP 8.2.35
  10. …of all days it would genuinely give me pause for caution. edit: yeah, really not feeling that: https://github.com/php/php-src/compare/php-8.2.34..php-8.2.3... Hopefully just a mistake? But looks like a botched release at the least
    comment by ytxm · 2026-10-21 · in PHP 8.2.35
  11. https://github.com/php/php-src/commit/01a40e89fbfc499936e3b0... What everyone is looking for.
    comment by charcircuit · 2026-10-21 · in PHP 8.2.35
  12. Advisories with the details are public: https://github.com/php/php-src/security/advisories/GHSA-w8hw... https://github.com/php/php-src/security/advisories/GHSA-6wmf...
    comment by tux3 · 2026-10-21 · in PHP 8.2.35
  13. …full technical details: https://www.php.net/archive/2026.php#2026-10-21-5 RCE via OOM corruption - https://github.com/php/php-src/security/advisories/GHSA-w8hw... RCE via stale global state - https://github.com/php/php-src/security/advisori…
    comment by nr378 · 2026-10-21 · in Security advisory: Critical remote code execution vulnerabilities, update now
  14. …needing to ssh into 100k+ machines on support rotation & never having emacs on any of them. [1] - https://github.com/php/php-src/blob/master/.gdbinit
    comment by gopalv · 2026-09-11 · in Show HN: Toast, a by default in-terminal IDE
  15. …your question, probably not. I dated the PHP change that added this "optimization" back to 2014 ( https://github.com/php/php-src/commit/b547e1358d3846fad4cd0c... ), while DynAsm only started being used around 2019 (…
    comment by purplesyringa · 2026-07-23 · in Log is non-monotonic in PHP and Lua
  16. …hashset regardless of input. Edit: found an example which does different things depending on input https://github.com/php/php-src/blob/master/ext/standard/arra... This does the usual hashset based approach only if the array has strings.…
    comment by porridgeraisin · 2025-03-12 · in What makes code hard to read: Visual patterns of complexity (2023)
  17. …you have to check how php populates the $_COOKIE superglobal I think it is somewhere is this file: https://github.com/php/php-src/blob/master/main/php_variable...
    comment by arkh · 2024-11-22 · in Handling cookies is a minefield
  18. Tagged release on GitHub: https://github.com/php/php-src/releases/tag/php-8.4.0 Downloads on php.net expected on Nov 21, 2024.
    comment by petecooper · 2024-11-19 · in PHP 8.4.0
  19. …cool! If anybody is interested in looking at the bugs that were found, they can be found on Github: https://github.com/php/php-src/issues?q=author%3AYuanchengJi... If you work with some interpreted language that is written in C or C++, it…
    comment by mmsc · 2024-11-17 · in Fuzzing the PHP Interpreter via Dataflow Fusion
  20. …the person who added this code to PHP[1][2]. [1]: https://stackoverflow.com/a/8194500/2805120 [2]: https://github.com/php/php-src/blob/master/ext/session/sessi...
    comment by jkrejcha · 2024-08-14 · in Tell HN: Server error (5xx) in Google Search Console may not be 5xx at all
  21. …racker.ietf.org/doc/html/rfc6979#section-3.2 But you can also see this technique in CSPRNG code; i.e. https://github.com/php/php-src/blob/d40726670fd2915dcd807673...
    comment by some_furry · 2024-04-15 · in PuTTY vulnerability vuln-p521-bias
  22. …by default on FreeBSD - my PR is pending, and the patch has been in testing in ports for a while: https://github.com/php/php-src/pull/12288
    comment by Freaky · 2023-11-24 · in PHP 8.3
  23. I guess there will be one last release towards Nov 23, because I'm already seeing some activity ( https://github.com/php/php-src/commits/PHP-8.1/ ).
    comment by Ayesh · 2023-10-28 · in PHP 8.1.25
  24. …But the old implementation had pointers to next and last (previous) element in the list: https://github.com/php/php-src/blob/PHP-5.3/Zend/zend_hash.h...
    comment by johannes1234321 · 2023-08-21 · in Ruby's hash is a Swiss-army knife
  25. …is: https://github.com/org/repo/tags.atom https://github.com/org/repo/releases.atom For example: https://github.com/php/php-src/tags.atom https://github.com/textpattern/textpattern/releases.atom Chuck a bunch of those into your reader of…
    comment by petecooper · 2023-06-20 · in Style your RSS feed
  26. Yes, fixed in all (at the time) supported versions in October last year [0]. [0]: https://github.com/php/php-src/commit/248f647
    comment by tomudding · 2023-03-07 · in A Vulnerability in Implementations of SHA-3, Shake, EdDSA
  27. The GitHub advisory is a better location to point this submission to: https://github.com/php/php-src/security/advisories/GHSA-7fj2...
    comment by captn3m0 · 2023-02-23 · in PHP bug: Password_verify() always return true with some hash
  28. More info: https://github.com/php/php-src/security/advisories/GHSA-7fj2... seems to be caused by a strange non-std php-specific crypto implementation
    comment by mjburgess · 2023-02-23 · in PHP bug: Password_verify() always return true with some hash
  29. Looking at the forked PHP source https://github.com/php/php-src/compare/master...dunglas:php-... I do not expect compatibility issues.
    comment by chx · 2022-10-14 · in Show HN: FrankenPHP, an app server for PHP written in Go
  30. Belief isn’t required: https://github.com/php/php-src/blob/master/php.ini-productio... I suspect many people don’t RTFM or have any idea what they are doing with php (or js) because they are historically “entry-level” languages.
    comment by withinboredom · 2022-09-04 · in Myths About CGI Scalability
  31. …through everything in the file and often end up learning new stuff! For those who've never seen it: https://github.com/php/php-src/blob/master/php.ini-productio...
    comment by notRobot · 2022-09-03 · in Ask HN: What is the best config file documentation you have seen?
  32. Here's the latest optimization to that func: https://github.com/php/php-src/commit/085b360abb622abc18b955... In the latest addendum on the blog post, I ended up removing the counting of 1s.
    comment by withinboredom · 2022-03-18 · in Yes, PHP is faster than C#
  33. …://www.morling.dev/blog/fizzbuzz-simd-style/ ): - PHP isn't optimized anywhere , but at least it's C: https://github.com/php/php-src/blob/1c0e613cf1a24cdc159861e4... - Python's C implementation is the same:…
    comment by mschuster91 · 2021-12-16 · in Leveraging SIMD: Splitting CSV Files at 3Gb/S
  34. …https://www.php.net/manual/en/function.password-hash.php ) and then there's also the source code: https://github.com/php/php-src/blob/bf92bddb878dbd86d23db290...
    comment by al2o3cr · 2021-10-30 · in Ask HN: What is the default password hash algorithm for Wordpress?
  35. …that without using a GIL, instead it internally uses something called Thread-Safe Resource Manager https://github.com/php/php-src/tree/master/TSRM I have written about this recently https://news.ycombinator.com/item?id=28692014
    comment by tored · 2021-10-18 · in Python stands to lose its GIL, and gain a lot of speed
  36. …of the commits aren't signed. So no, this would probably not work for identifying everyone. [0] https://github.com/php/php-src/commits/master
    comment by Sebb767 · 2021-03-29 · in PHP's Git server compromised, moving to GitHub
  37. …that they've had access since 2017? [1] Maybe they just wanted to burn it now for some reason. [1] https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad...
    comment by Ndymium · 2021-03-29 · in PHP's Git server compromised, moving to GitHub
  38. …be in their interest for the exploit to actually go through. [0] https://www.zerodium.com/ [1] https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad... [2] https://bugs.php.net/bug.php?id=78224 (only mention I found with a…
    comment by Sebb767 · 2021-03-29 · in PHP's Git server compromised, moving to GitHub
  39. …structures containing circular references. (I was involved in the development of this function: https://github.com/php/php-src/pull/4886 )
    comment by duskwuff · 2021-01-30 · in What's New in PHP 8.1
  40. C++ with lots of extern "C" , I imagine. Two examples: https://github.com/Perl/perl5/search?q=extern https://github.com/php/php-src/search?q=extern
    comment by tyingq · 2020-11-17 · in Best aspects of C
  41. …quite out of date as PHP has switched to a tracing JIT which appears to be heavily based on LuaJIT. https://github.com/php/php-src/pull/5874 https://github.com/php/php-src/commit/4bf2d09edeb14467ba7955...
    comment by jashmatthews · 2020-08-30 · in Deep Dive into PHP 8's JIT
  42. …for an upgrade to not break something. There are dozens of breaking changes in this release alone: https://github.com/php/php-src/blob/96c7d42a3ca9d822a08b3dd4... Some of the changes are sadistic. "The precedence of the concatenation…
    comment by john-shaffer · 2020-08-14 · in What's new in PHP 8?
  43. PHP 8 has plenty of breaking changes ( https://github.com/php/php-src/blob/08e6c209550a268500bbdef4... ), mostly in the department of throwing errors more aggressively, and fixing some long-standing "features" (like 0 == "foobar" being…
    comment by nikic · 2020-07-27 · in Named arguments are coming in PHP 8
  44. …A patch to disable the use of huge pages in memory allocator fixed a 10% performance regression: https://github.com/php/php-src/commit/928c42211f737640e4dc3c... The patch to enable the Zend Optimizer on ARM64 accounts for about 5% of…
    comment by rob-olmos · 2020-07-17 · in Improving Performance of PHP for Arm64 and Impact on Amazon EC2 M6g Instances
  45. Yes, they are using DynASM. https://github.com/php/php-src/blob/master/ext/opcache/jit/R...
    comment by tyingq · 2020-07-17 · in Improving Performance of PHP for Arm64 and Impact on Amazon EC2 M6g Instances
  46. There's pressure to change blacklist and whitelist to blocklist and allow list too... https://github.com/php/php-src/pull/5685
    comment by gitgud · 2020-06-15 · in Show HN: Script that changes GitHub default branches to master
  47. There was an RFC for that, but it was voted out: https://github.com/php/php-src/pull/2049
    comment by SergeAx · 2020-06-10 · in 25 Years of PHP
  48. …with new technologies. [1] https://symfony.com/blog/symfony-was-the-backend-framework-w... [2] https://github.com/php/php-src/pulse [3] https://trends.builtwith.com/framework/Laravel
    comment by s1k3s · 2020-05-05 · in A look at modern PHP
  49. …look like this [0] (imagine it all implemented in assembly, without C's types, if you prefer). [0]: https://github.com/php/php-src/blob/3709e74b5e495e210ada8039...
    comment by jbboehr · 2020-04-08 · in How porting to TypeScript solved our API woes
  50. …1 in case the header is present so strstr isn't being called an extra time in the current code. [1] https://github.com/php/php-src/commit/3d9c02364db62a6d8e2794...
    comment by miguelxpn · 2020-03-02 · in I found and fixed a bug in PHP's standard library