{"id":183958,"date":"2026-10-22T17:40:23","date_gmt":"2026-10-22T15:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/narusheniya-embargo-i-zatyagivanie-razrabotki-patchej-v-hode-ustraneniya-uyazvimostej-v-php"},"modified":"2026-10-22T17:40:28","modified_gmt":"2026-10-22T15:40:28","slug":"embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","title":{"rendered":"Kr\u0161enje embarga i odga\u0111anje razvoja zakrpa tokom rje\u0161avanja ranjivosti u PHP-u","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

PHP developeri objavili su izvje\u0161taj o problemima koji su nastali tijekom rje\u0161avanja ju\u010der ispravljenih kriti\u010dnih ranjivosti u PHP-u. Informacija o ranjivosti koja se pojavila zbog iscrpljenja dostupne memorije dobivena je tijekom vanjskog audita 2024. godine, ali je prvotno shva\u0107ena kao teoretska mogu\u0107nost napada. Ispravak je odgo\u0111en zbog problema postizanja konsenzusa me\u0111u PHP developerima o na\u010dinu rje\u0161avanja ranjivosti. Razmatrane su nekoliko konkurentnih prijedloga o rje\u0161enju problema, od kojih je svaki imao svoje nedostatke. Trebalo je birati izme\u0111u kr\u0161enja unazadne kompatibilnosti, pojave novih vektora za napade koji izazivaju uskra\u0107ivanje usluga i potrebe za izmjenom niza dodataka tre\u0107ih strana. <\/p>\n

Prije nekoliko mjeseci, tvrtke Calif i Wiz su neovisno jedna o drugoj pomo\u0107u AI modela GPT\u20115.6 i Gemini 4 Argon identificirale radne metode iskori\u0161tavanja problema i 11. i 24. kolovoza 2026. godine obavijestile programere PHP-a o tome. Nakon toga, razvoju ispravaka dodijeljen je najvi\u0161i prioritet i zapo\u010deta je reforma procesa dono\u0161enja odluka za br\u017ee odgovaranje na pitanja vezana uz slo\u017eene kompromisne situacije (takve odluke sada se mogu donositi ve\u0107inom glasova bez stroge potrebe za postizanjem konsenzusa).<\/p>\n

Izvorno, uskla\u0111eno s distribucijama, datum objave ispravka bio je zakazan za 22. listopada, ali je kasnije pomjeren na 21. listopada nakon curenja informacija o CVE identifikatorima i neto\u010dnih podataka o vremenu objavljivanja predstoje\u0107ih korektivnih izdanja na dru\u0161tvenim mre\u017eama 20. listopada. <\/p>\n

Ubrzo nakon najave predstoje\u0107ih ispravaka, tvrtka Calif, koja je otkrila jednu od ranjivosti, gre\u0161kom je objavila video s demonstracijom rada eksploit, u kojem su se mogle primijetiti neke detalje koji omogu\u0107uju su\u017eavanje pretra\u017eivanja i rekonstrukciju informacije o problemu. Video je brzo uklonjen, \u0161to je samo potaknulo istra\u017eiva\u010de da dublje istra\u017euju su\u0161tinu ranjivosti i ubrzali rad na alternativnim prototipovima eksploitova. <\/p>\n

Osim toga, \u0161est sati prije planiranog objavljivanja ispravki, tvrtka Chainguard prekr\u0161ila je embargo i objavila verzije svog distribucijskog paketa koje sadr\u017ee ispravljenu verziju PHP-a. Ovakvo kr\u0161enje omogu\u0107ilo je napada\u010dima da prou\u010de ispravke prije slu\u017ebenog izdanja, a tako\u0111er je poni\u0161tilo sav rad na koordiniranom otkrivanju informacija i istovremenom objavljivanju ispravki u razli\u010ditim distribucijama.<\/p>\n

Dopuna: \u0160esnaest sati nakon otkrivanja detalja o ranjivostima univerzalnog radnog eksploita, jo\u0161 nije do\u0161lo do masovnih napada, \u0161to se obja\u0161njava slo\u017eeno\u0161\u0107u iskori\u0161tavanja ranjivosti zbog potrebe za odre\u0111ivanjem rasporeda struktura u memoriji procesa, koji je specifi\u010dan za svaku verziju. Objavljeni radni prototipovi eksploita vezani su uz pojedina\u010dne konfiguracije i izvo\u0111enje napada u laboratorijskim uvjetima. Tako\u0111er su se pojavile mnoge la\u017ene eksploite, koje su halucinacije AI-a, koje samo stvaraju privid napada, zasnovane na gre\u0161kama u konfiguraciji ili funkcioniraju samo uz prisutnost drugih kriti\u010dnih ranjivosti.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0451\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0447\u0435\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438, \u0431\u044b\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0435\u0449\u0451 \u0432 2024 \u0433\u043e\u0434\u0443, \u043d\u043e \u0431\u044b\u043b\u0430 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u0430 \u043b\u0438\u0448\u044c \u043a\u0430\u043a \u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0442\u044f\u043d\u0443\u043b\u043e\u0441\u044c \u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0441\u0435\u043d\u0441\u0443\u0441\u0430 \u0441\u0440\u0435\u0434\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP \u043e \u0441\u043f\u043e\u0441\u043e\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183958","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Prekidi embarga i odgo\u0111eni razvoj zakrpa tijekom otklanjanja ranjivosti u PHP-u | ProHoster","description":"PHP programeri objavili su izvje\u0161taj o problemima koji su se pojavili tijekom otklanjanja ju\u010der ispravljenih kriti\u010dnih ranjivosti u PHP-u.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0438 \u0437\u0430\u0442\u044f\u0433\u0438\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0430\u0442\u0447\u0435\u0439 \u0432 \u0445\u043e\u0434\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0451\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0447\u0435\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-22T15:40:23+00:00","article:modified_time":"2026-10-22T15:40:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=183958"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183958\/revisions"}],"predecessor-version":[{"id":183959,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/183958\/revisions\/183959"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=183958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=183958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=183958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}