Potential third critical PHP CVE

Commenters debated whether the reported "third" PHP CVE is actually serious. nr378 and hannob argued the stack trace matches a known GC regression in 8.5.12 and that allocator shadow protections prevent exploitation, so it does not produce remote code execution and is not a critical CVE. athrowaway3z said their reproduction attempts turned up nothing, and bawolff and others recommended waiting for an official PHP announcement because the sparse trigger information could mean anything from harmless to severe. Multiple commenters emphasized that a use-after-free or double-free alone doesn’t establish a critical vulnerability; exploitability and a remote path are what matter.

Other commenters voiced frustration and distrust of PHP’s security posture. rvz declared "PHP is done," and akersten expressed skepticism that the dev team fully explored ramifications after a delayed audit and quick public disclosure. Some responses were sarcastic or dismissive, including meme-style mitigation quips, while others told alarmist takes to stop. The split is between those treating this as likely a non-exploitable, low-impact issue and those worried about recurring memory bugs and the project's ability to audit and triage security problems thoroughly.