ugh. the patch is massive 🫩 the bug is based on causing an OOM condition and no-one ever accused the php interpreter of being neatly and elegantly architected, so the fix touches everything 🫩 the bugs go back many years but backporting the fix to all those versions is wildly impractical 🫩
the exploit was developed with AI assistance but it was based on existing human research, including by my old nemesis Stefan Esser. I don't remember why he's my nemesis, I assume we got into a stupid twitter argument over nothing like 16 years ago
abadidea
npub1n7…07g0f
2026-10-21 14:47:44 UTC
Author Public Key
npub1n7kt2deqy3xk93nzcvxyy0twcw3jmhvyjhec0pss4punpsyr884ql07g0fPublished at
2026-10-21 14:47:44 UTCEvent JSON
{
"id": "bcafbea981e13198e72e7c3c9f955ed9a051bd9a7a768e3eb1e4a6f073764936",
"pubkey": "9facb53720244d62c662c30c423d6ec3a32ddd8495f3878610a87930c08339ea",
"created_at": 1792594064,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@0xabad1dea/117479444582375740",
"web"
],
[
"proxy",
"https://infosec.exchange/users/0xabad1dea/statuses/117479444582375740",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/0xabad1dea/statuses/117479444582375740",
"pink.momostr"
],
[
"-"
]
],
"content": "ugh. the patch is massive 🫩 the bug is based on causing an OOM condition and no-one ever accused the php interpreter of being neatly and elegantly architected, so the fix touches everything 🫩 the bugs go back many years but backporting the fix to all those versions is wildly impractical 🫩 \n\nthe exploit was developed with AI assistance but it was based on existing human research, including by my old nemesis Stefan Esser. I don't remember why he's my nemesis, I assume we got into a stupid twitter argument over nothing like 16 years ago",
"sig": "853012fb3dc99b8c442db3aefc15205465e5a71920d1967b85a86b3201147bf90be6f8febd2ee8cd79b01083c50c55089393ab044fa96ecff6793995fa68a527"
}