The PHP fix for CVE-2026-109618 and CVE-2026-109619: +11556 lines of code
github.com
2 threads
Can it really take over 10k additional lines to fix a pointer issue bug like this, where the problem is that the code uses memory that it has freed already?
I wished they had put the tests in a commit on their own so it would be immediately clear how large the patch itself is.
This is about the code itself. Not about the availability.
Fair, just not sure you'll get a lot of traction on a separate thread when there's that and other active discussions on the release over there. Maybe get some more interest with a comment in that thread.