Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119218
Feedback-ID: id4a9467a:Fastmail
User-Agent: Cyrus-JMAP/3.7.0-alpha0-1185-g841157300a-fm-20221208.002-g84115730
Mime-Version: 1.0
Message-ID: <59f61bd5-8212-47af-857e-b452705b1811@app.fastmail.com>
In-Reply-To: <8fbb3af9-5fb5-1220-3b88-a42f5aaa40ef@gmx.de>
References: 
 <CAF+90c90pTtjxuMaQ88h+njhByfbv4qs=xx72CVPSw40tde6Cg@mail.gmail.com>
 <dde40b06-93c4-cb5b-0abf-48dfd8781fdf@telia.com>
 <CAF+90c_=GhEy0pX5wp9Hcj5+D31tjhhKBCSDCs4ofAoZj00_fA@mail.gmail.com>
 <25f35ef5-7f86-9aa3-a069-195a1ed39a91@gmx.de>
 <CACwt+JeLADQC6QvFt4m1gZCZ+oEeQnhSun-37T39bAR1N-uBjQ@mail.gmail.com>
 <CAF+90c9_u2BgDKywLMCfx9C3mFz-a-XZFeMe8NCvk8w4Fr1R0Q@mail.gmail.com>
 <CAJp_myWdQze1_WuL9ddDoi+1UTLUNz+9nU5_7hiKGG_-QhVqjg@mail.gmail.com>
 <d68fc8c9-4e5e-2bd7-6e02-e5afe1fc4c10@gmail.com>
 <CAF+90c-Lbtav0dhAuPi0g2hox2MgNNRNagzxusBSoWvAAg-2Ow@mail.gmail.com>
 <8fbb3af9-5fb5-1220-3b88-a42f5aaa40ef@gmx.de>
Date: Fri, 30 Dec 2022 22:12:36 +0100
To: "Christoph M. Becker" <cmbecker69@gmx.de>,
 "Stanislav Malyshev" <smalyshev@gmail.com>,
 "security@php.net" <security@php.net>
Cc: internals@lists.php.net
Content-Type: multipart/alternative;
 boundary=7d0d1b8a18f644edab1adc401b8f4d3d
Subject: Re: [PHP-DEV] Re: [RFC] Migrating to GitHub issues
From: nikita.ppv@gmail.com ("Nikita Popov")

--7d0d1b8a18f644edab1adc401b8f4d3d
Content-Type: text/plain

On Thu, Nov 10, 2022, at 14:29, Christoph M. Becker wrote:
> On 09.11.2022 at 23:27, Nikita Popov wrote:
> 
> > It looks like GitHub has just added support for private security reports:
> > https://github.blog/changelog/2022-11-09-privately-report-vulnerabilities-to-repository-maintainers/
> >
> > I haven't looked into the details, but it probably makes sense to enable
> > those on php-src and make this our official venue for security bug reports.
> > This would allow retiring the last remaining use of bugs.php.net (well,
> > apart from the archive of old issues, which should of course remain).
> 
> I agree, but maybe the security team is in favor of sticking with
> bugs.php.net.

I noticed that the php-src repo does enable private vulnerability reports now, and there is one sitting around without response at https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv.

Possibly this was enabled unintentionally / without coordination with the security team? That should probably either be disabled again, or someone needs to keep an eye on it.

Regards,
Nikita
--7d0d1b8a18f644edab1adc401b8f4d3d--