Repository navigation
1.12.0: KEV in the timeline, and the root-cause work cited - #5
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things this report was missing, both found by looking at what else is published.
The KEV listing was not in the timeline. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on 2026-10-26, with a federal due date of 29 Oct, and on 28 Oct added CVE-2026-46300 (Linux kernel), documented as chainable with this pair to reach root. The timeline stopped at "KEV still does not list either CVE" on 21 Oct and never picked the rest up. For a report whose value is the timeline, that is the single most operationally relevant row to be missing.
No related work section. The root-cause analysis is not in this repository and never was: it is in Wiz (co-discoverer), CrowdStrike (the
_zend_hash_str_add_or_update_ibookkeeping and the uninitializedemallocbucket), Keysight (call-chain walkthrough with packet captures), mekhalleh/php2shell-advisory (the ordering bug with source lines and thephp_basic_early_rinit()fix) and Exaforce (why the early "session UAF" framing was a trigger, not the cause).READMEnow cites each one and states what this repository adds on top: per-cell counts with controls, the portability matrix, the retracted claims, and the conditions under which each number holds.Both in English and Spanish. No measurement changed.