{"id":183958,"date":"2026-10-22T17:40:23","date_gmt":"2026-10-22T15:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/narusheniya-embargo-i-zatyagivanie-razrabotki-patchej-v-hode-ustraneniya-uyazvimostej-v-php"},"modified":"2026-10-22T17:40:28","modified_gmt":"2026-10-22T15:40:28","slug":"embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","title":{"rendered":"\u00cenc\u0103lc\u0103ri ale embargoului \u0219i \u00eent\u00e2rzierea dezvolt\u0103rii patch-urilor \u00een timpul remedierii vulnerabilit\u0103\u021bilor \u00een PHP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii PHP au publicat un raport despre problemele \u00eent\u00e2mpinate \u00een procesul de remediere a vulnerabilit\u0103\u021bilor critice corectate ieri \u00een PHP. Informa\u021biile despre vulnerabilitatea ap\u0103rut\u0103 din epuizarea memoriei disponibile au fost ob\u021binute \u00een urma unui audit extern \u00een 2024, dar au fost percepute doar ca o posibilitate teoretic\u0103 de atac. Remedierea a fost \u00eent\u00e2rziat\u0103 din cauza problemelor de consens \u00eentre dezvoltatorii PHP privind modalitatea de a aborda vulnerabilitatea. Au fost luate \u00een considerare mai multe propuneri concurente pentru rezolvarea problemei, fiecare av\u00e2nd dezavantajele sale. A fost necesar s\u0103 se aleag\u0103 \u00eentre \u00eenc\u0103lcarea compatibilit\u0103\u021bii inverse, apari\u021bia de noi vectori de atac care provoac\u0103 atacuri de tip denial-of-service \u0219i necesitatea de a modifica numeroase extensii externe. <\/p>\n

Cu c\u00e2teva luni \u00een urm\u0103, companiile Calif \u0219i Wiz au identificat, independent una de cealalt\u0103, metodele de exploatare a problemei cu ajutorul modelelor AI GPT\u20115.6 \u0219i Gemini 4 Argon. Pe 11 \u0219i 24 august 2026, acestea au informat dezvoltatorii PHP despre descoperiri. Ca rezultat, dezvoltarea corec\u021biilor a fost declarat\u0103 prioritate maxim\u0103, iar procesul de luare a deciziilor a fost reformulat pentru a r\u0103spunde mai rapid la problemele legate de compromisurile complexe (astfel de decizii pot fi acum adoptate cu majoritatea voturilor, f\u0103r\u0103 a se atinge un consens strict).<\/p>\n

Ini\u021bial, data public\u0103rii coordonate cu distribu\u021biile pentru remediere era stabilit\u0103 pe 22 octombrie, dar apoi a fost mutat\u0103 pe 21 octombrie dup\u0103 scurgerea de pe 20 octombrie \u00een re\u021belele sociale a informa\u021biilor despre identificatorii CVE \u0219i datele incorecte privind ora public\u0103rii viitoarelor versiuni corective. <\/p>\n

La scurt timp dup\u0103 anun\u021barea remedierilor viitoare, compania Calif, care a identificat una dintre vulnerabilit\u0103\u021bi, a publicat din gre\u0219eal\u0103 un videoclip demonstrativ al exploatului, \u00een care erau vizibile unele detalii care permiteau restr\u00e2ngerea domeniului de c\u0103utare \u0219i recrearea informa\u021biilor despre problem\u0103. Videoclipul a fost \u0219ters rapid, ceea ce a stimulat \u0219i mai mult dorin\u021ba cercet\u0103torilor de a descoperi esen\u021ba vulnerabilit\u0103\u021bii \u0219i a accelerat lucr\u0103rile la prototipuri alternative de exploate. <\/p>\n

\u00cen plus, cu \u0219ase ore \u00eenainte de publicarea programat\u0103 a corec\u021biilor, compania Chainguard a \u00eenc\u0103lcat embargoul \u0219i a publicat versiunile distribu\u021biei sale, con\u021bin\u00e2nd versiunea corectat\u0103 a PHP. Aceast\u0103 violare a oferit infractorilor ocazia de a studia corec\u021bia \u00eenainte de lansarea oficial\u0103, \u0219terg\u00e2nd astfel \u00eentreaga munc\u0103 de divulgare coordonat\u0103 \u0219i publicarea simultan\u0103 a corec\u021biilor \u00een diferite distribu\u021bii.<\/p>\n

Complement: La 16 ore dup\u0103 dezv\u0103luirea detaliilor despre vulnerabilit\u0103\u021bile exploit-ului universal, nu au ap\u0103rut atacuri \u00een mas\u0103, ceea ce se explic\u0103 prin complexitatea exploat\u0103rii vulnerabilit\u0103\u021bii din cauza necesit\u0103\u021bii de a determina aranjamentul structurilor din memoria procesului, care este specific pentru fiecare versiune. Prototipurile de exploatare publicate sunt legate de configura\u021bii individuale \u0219i de desf\u0103\u0219urarea atacurilor \u00een condi\u021bii de laborator. De asemenea, au ap\u0103rut multe exploat\u0103ri false, care sunt halucina\u021bii AI, care creeaz\u0103 doar iluzia unui atac, baz\u00e2ndu-se pe erori de configura\u021bie sau func\u021bion\u00e2nd doar \u00een prezen\u021ba altor vulnerabilit\u0103\u021bi critice.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0451\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0447\u0435\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438, \u0431\u044b\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0435\u0449\u0451 \u0432 2024 \u0433\u043e\u0434\u0443, \u043d\u043e \u0431\u044b\u043b\u0430 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u0430 \u043b\u0438\u0448\u044c \u043a\u0430\u043a \u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0442\u044f\u043d\u0443\u043b\u043e\u0441\u044c \u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0441\u0435\u043d\u0441\u0443\u0441\u0430 \u0441\u0440\u0435\u0434\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP \u043e \u0441\u043f\u043e\u0441\u043e\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183958","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cenc\u0103lcarea embargoului \u0219i \u00eent\u00e2rzieri \u00een dezvoltarea patch-urilor \u00een procesul de remediere a vulnerabilit\u0103\u021bilor \u00een PHP | ProHoster","description":"Dezvoltatorii PHP au publicat un raport despre problemele \u00eent\u00e2mpinate \u00een procesul de remediere a vulnerabilit\u0103\u021bilor critice corectate ieri \u00een PHP.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0438 \u0437\u0430\u0442\u044f\u0433\u0438\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0430\u0442\u0447\u0435\u0439 \u0432 \u0445\u043e\u0434\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0451\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0447\u0435\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-22T15:40:23+00:00","article:modified_time":"2026-10-22T15:40:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=183958"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183958\/revisions"}],"predecessor-version":[{"id":183959,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183958\/revisions\/183959"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=183958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=183958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=183958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}