Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121137
MIME-Version: 1.0
References: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
In-Reply-To: <98cb519e-4b45-5069-9f48-6e78dddf3284@php.net>
Date: Mon, 25 Sep 2023 15:13:24 +0200
Message-ID: <CAJmy8YESp+qup1+un3dPh9zahUwjWcgexo3qjDW8cgjFndB7+A@mail.gmail.com>
To: Derick Rethans <derick@php.net>
Cc: PHP Developers Mailing List <internals@lists.php.net>, PHP Security List <security@php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Security Audit Priorities
From: divinity76@gmail.com (Hans Henrik Bergan)

the php-fpm master<->php-fpm worker glue code. php-fpm master usually
runs as *root*, so a compromise in that glue could lead to webserver
rooting

On Mon, 25 Sept 2023 at 10:49, Derick Rethans <derick@php.net> wrote:
>
> Hi,
>
> The Foundation is organising an external audit/security check of the PHP
> source code. As part of that, we would like to identify the places in
> the PHP source code where checking this will have the most impact.
>
> Typical areas would be where user input can be (automatically read) remotely, such as
> our RFC 1867 HTTP header parser. But we are sure there are other
> important areas as well, and we would like your input.
>
> So, if you can suggest an area where doing an external review would have
> high impact, please reply to this email.
>
> cheers,
> Derick
>
> --
> https://derickrethans.nl | https://xdebug.org | https://dram.io
>
> Author of Xdebug. Like it? Consider supporting me: https://xdebug.org/support
> Host of PHP Internals News: https://phpinternals.news
>
> mastodon: @derickr@phpc.social @xdebug@phpc.social
> twitter: @derickr and @xdebug
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>