{"id":183958,"date":"2026-10-22T17:40:23","date_gmt":"2026-10-22T15:40:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/narusheniya-embargo-i-zatyagivanie-razrabotki-patchej-v-hode-ustraneniya-uyazvimostej-v-php"},"modified":"2026-10-22T17:40:28","modified_gmt":"2026-10-22T15:40:28","slug":"embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","title":{"rendered":"Kr\u0161enje embarga in zamude pri razvoju popravkov med odpravljanjem ranljivosti v PHP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Razvijalci PHP so objavili poro\u010dilo o te\u017eavah, ki so se pojavile med odpravo v\u010deraj popravljene kriti\u010dne ranljivosti v PHP. Informacije o ranljivosti, ki nastane ob iz\u010drpanju razpolo\u017eljive pomnilnika, so bile pridobljene med zunanjim pregledom \u017ee leta 2024, vendar so bile obravnavane le kot teoreti\u010dna mo\u017enost napada. Popravilo se je zavleklo zaradi te\u017eav pri doseganju konsenza med razvijalci PHP o na\u010dinu re\u0161evanja ranljivosti. Razvijala so se \u0161tevilna konkuren\u010dna predlogi za re\u0161itev te\u017eave, vsaka od katerih je imela svoje pomanjkljivosti. Treba je bilo izbirati med kr\u0161enjem nazaj kompatibilnosti, pojavom novih vektorjev napadov, ki povzro\u010dajo zavrnitev storitve, in potrebo po spremembah v \u0161tevilnih zunanjih dodatkih. <\/p>\n

Pred nekaj meseci sta podjetji Calif in Wiz neodvisno od drugih z uporabo modelov AI GPT\u20115.6 in Gemini 4 Argon odkrili delujo\u010de metode izkori\u0161\u010danja te\u017eave in 11. ter 24. avgusta 2026 obvestili razvijalce PHP. Po tem je bila razvoju popravkov dodeljena najvi\u0161ja prioriteta in za\u010dela se je reforma procesa odlo\u010danja za hitrej\u0161e odzivanje na vpra\u0161anja, povezana s kompleksnimi kompromisi (tak\u0161ne odlo\u010ditve je zdaj mogo\u010de sprejeti z ve\u010dino glasov brez strogega doseganja konsenza).<\/p>\n

Sprva je bila usklajena z distribucijami, datum objave popravkov predviden na 22. oktober, vendar je bil nato prestavljen na 21. oktober po uhajanju 20. oktobra v dru\u017ebena omre\u017eja informacij o CVE identifikatorjih in neto\u010dnih podatkih o \u010dasu objave prihajajo\u010dih popravkov. <\/p>\n

Kmalu po napovedi prihajajo\u010dih popravkov je podjetje Calif, ki je odkrilo eno od ranljivosti, pomotoma objavilo video z demonstracijo delovanja eksploita, v katerem so bili opazni nekateri detajli, ki so omogo\u010dili zo\u017eitev iskanja in obnavljanja informacij o te\u017eavi. Video je bil hitro odstranjen, kar je le spodbudilo raziskovalce, da so se poglobili v bistvo ranljivosti in pospe\u0161ilo delo na alternativnih prototipih eksploita. <\/p>\n

Poleg tega je podjetje Chainguard \u0161est ur pred na\u010drtovanim objavljenjem popravkov prekr\u0161ilo embargo in objavilo razli\u010dice svoje distribucije, ki vsebujejo popravljeno razli\u010dico PHP. Tak\u0161no kr\u0161enje je omogo\u010dilo zlonamernim akterjem, da preu\u010dijo popravke pred uradnim izdajo, in hkrati uni\u010dilo ves trud za usklajeno razkritje informacij ter hkraten izpust popravkov v razli\u010dnih distribucijah.<\/p>\n

Dopolnilo: \u0160estnajst ur po razkritju podrobnosti o ranljivostih univerzalnega delovnega izkori\u0161\u010danja \u0161e ni pri\u0161lo do mno\u017ei\u010dnih napadov, kar je pojasnjeno s te\u017eavnostjo izkori\u0161\u010danja ranljivosti zaradi potrebe po dolo\u010danju razporeditve struktur v pomnilniku procesa, ki je specifi\u010dna za vsako razli\u010dico. Objavljeni delujo\u010di prototipi izkori\u0161\u010danja so vezani na posamezne konfiguracije in izvajanje napadov v laboratorijskih pogojih. Pojavilo se je tudi veliko la\u017enih izkori\u0161\u010danj, ki so posledica halucinacij AI, ki le ustvarjajo videz napada, vezanega na napake v konfiguraciji ali delujejo samo ob prisotnosti drugih kriti\u010dnih ranljivosti.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0451\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0447\u0435\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438, \u0431\u044b\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0430 \u0432 \u0445\u043e\u0434\u0435 \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u0435\u0449\u0451 \u0432 2024 \u0433\u043e\u0434\u0443, \u043d\u043e \u0431\u044b\u043b\u0430 \u0432\u043e\u0441\u043f\u0440\u0438\u043d\u044f\u0442\u0430 \u043b\u0438\u0448\u044c \u043a\u0430\u043a \u0442\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0442\u044f\u043d\u0443\u043b\u043e\u0441\u044c \u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043d\u0441\u0435\u043d\u0441\u0443\u0441\u0430 \u0441\u0440\u0435\u0434\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 PHP \u043e \u0441\u043f\u043e\u0441\u043e\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183958","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kr\u0161enje embarga in zavla\u010devanje z razvojem popravil med odpravo ranljivosti v PHP | ProHoster","description":"Razvijalci PHP so objavili poro\u010dilo o te\u017eavah, ki so se pojavile med odpravo kriti\u010dnih ranljivosti, ki so bile odpravljene v\u010deraj.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u044d\u043c\u0431\u0430\u0440\u0433\u043e \u0438 \u0437\u0430\u0442\u044f\u0433\u0438\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0430\u0442\u0447\u0435\u0439 \u0432 \u0445\u043e\u0434\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u0447\u0451\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u0432\u043e\u0437\u043d\u0438\u043a\u0448\u0438\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0447\u0435\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/embargo-violations-and-patch-development-delays-in-php-vulnerability-remediation","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-22T15:40:23+00:00","article:modified_time":"2026-10-22T15:40:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=183958"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183958\/revisions"}],"predecessor-version":[{"id":183959,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183958\/revisions\/183959"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=183958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=183958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=183958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}