[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572963-105":53,"doc-detail-572963-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","php-src-audit-version-14-technical-report","PHP-SRC audit - Version 1.4 - Technical report","","PHP-SRC audit technical report for reference 24-07-1730-REP, developed in collaboration with Open Source Technology Improvement Fund, Inc., and authored by Quarkslab SAS. Version 1.4 dated 2025/03/14 consolidates project history, executive-level context, objectives, and methodology, and summarizes findings with recommendations and an action plan. The report defines metrics, threat modeling, and evaluates PHP components including cryptography, PHP-FPM, RFC 1867, PDO, and native MySQL driver.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/php-src-audit-version-14-technical-report/572963/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/php-src-audit-version-14-technical-report/572963.png","ImageObject",442,249,{"name":88,"@type":89},"dhado","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":73},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the reference and version of this PHP-SRC audit report?","Question",{"text":108,"@type":109},"The report reference is 24-07-1730-REP and it is version 1.4, dated 2025/03/14.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"Who collaborated on the PHP-SRC audit?",{"text":113,"@type":109},"Quarkslab SAS authored the report in collaboration with Open Source Technology Improvement Fund, Inc., and it references contacts from both OSTIF and PHP Foundation.",{"name":115,"@type":106,"acceptedAnswer":116},"Which PHP components are covered in the audit?",{"text":117,"@type":109},"The audit includes cryptography-related scope plus evaluations of PHP-FPM, RFC 1867, PDO, and the native MySQL driver, along with associated findings sections.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572963,1792381817,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":73,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},5909893218464,"https://ap-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","PHP-SRC audit  \nTechnical report, in Collaboration with Open Source Technology Improvement Fund, Inc.  \nReference 24-07-1730-REP  \nVersion 1.4  \nDate 2025/03/14  \nQuarkslab SAS  \n10 boulevard Haussmann  \n75009 Paris France  \n1. Project Information  \n\n| Document history |  |  |  |\n| --- | --- | --- | --- |\n| Version | Date | Details | Authors |\n| 1.0 | 2024/09/06 | Initial version | Julio Loayza Meneses Angèle Bossuat\u003Cbr>Mihail Kirov\u003Cbr>Sébastien Rolland |\n| 1.1 | 2024/09/11 | Minor updates after OSTIF feedback | Julio Loayza Meneses Angèle Bossuat\u003Cbr>Mihail Kirov\u003Cbr>Sébastien Rolland |\n| 1.2 | 2024/09/11 | Minor updates after PHP Foundation feedback | Julio Loayza Meneses Angèle Bossuat\u003Cbr>Mihail Kirov\u003Cbr>Sébastien Rolland |\n| 1.3 | 2025/02/10 | Removed details about security issues until fixes are applied | Julio Loayza Meneses Angèle Bossuat\u003Cbr>Mihail Kirov\u003Cbr>Sébastien Rolland |\n| 1.4 | 2025/03/14 | Minor updates after PHP Foundation feedback | Julio Loayza Meneses Angèle Bossuat\u003Cbr>Mihail Kirov\u003Cbr>Sébastien Rolland |\n\n\n| Quarkslab |  |  |\n| --- | --- | --- |\n| Contact | Role | Contact Address |\n| Frédéric Raynal | CEO |  [fraynal@quarkslab.com](fraynal@quarkslab.com)  |\n| Ramtine Tofighi Shirazi | Project Manager |  [mrtofighishirazi@quarkslab.com](mrtofighishirazi@quarkslab.com)  |\n| Sébastien Rolland | R&D Engineer |  [srolland@quarkslab.com](srolland@quarkslab.com)  |\n| Mihail Kirov | R&D Engineer |  [mkirov@quarkslab.com](mkirov@quarkslab.com)  |\n| Julio Loayza Meneses | Cryptography Expert |  [jloayzameneses@quarkslab.com](jloayzameneses@quarkslab.com)  |\n| Angèle Bossuat | Cryptography Expert |  [abossuat@quarkslab.com](abossuat@quarkslab.com)  |\n\n\n| OSTIF and PHP Foundation |  |  |\n| --- | --- | --- |\n| Contact | Role | Contact Address |\n| Derek Zimmer | Executive Director (OSTIF) |  [derek@ostif.org](derek@ostif.org)  |\n| Amir Montazery | Managing Director (OSTIF) |  [amir@ostif.org](amir@ostif.org)  |\n| Helen Woeste | Communications Manager (OSTIF) |  [helen@ostif.org](helen@ostif.org)  |\n| Roman Pronskiy | Operations Manager (PHP) |  [roman.pronskiy@jetbrains.com](roman.pronskiy@jetbrains.com)  |\n\nContents  \n1 Project Information 1  \n2 Executive Summary 5  \n2. 1 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5  \n2.2 Objectives ........................................ 5  \n2.3 Methodology ...................................... 6  \n2.4 Findings Summary ................................... 6  \n2.5 Recommendations and Action Plan . . . . . . . . . . . . . . . . . . . . . . . . . . 8  \n2.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11  \n3 Reading Guide 12  \n3.1 Executive summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12  \n3.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12  \n3.3 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13  \n3.4 Metrics definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13  \n3.4.1 Impact . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13  \n3.4.2 Likelihood . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13  \n3.4.3 Severity ..................................... 14  \n4 Introduction 15  \n4. 1 Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15  \n4.2 Scope .......................................... 15  \n4.2.1 Cryptography .................................. 16  \n4.3 Methodology ...................................... 16  \n5 Methodology 18  \n5.1 Cryptography ...................................... 18  \n5.2 PHP-FPM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18  \n5.3 MySQL Native Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18  \n5.4 RFC 1867 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ","cbCaivXFtSWXYXYR","https://ap.wps.com/l/cbCaivXFtSWXYXYR","pdf",942054,106,"English","# Project Information\n# Executive Summary\n## Context\n## Objectives\n## Methodology\n## Findings Summary\n## Recommendations and Action Plan\n## Conclusion\n# Reading Guide\n## Executive summary\n## Introduction\n## Methodology\n## Metrics definition\n## Impact\n## Likelihood\n## Severity\n# Introduction\n## Context\n## Scope\n## Cryptography\n## Methodology\n# Methodology\n## Cryptography\n## PHP-FPM\n## MySQL Native Driver\n## RFC 1867\n## PDO\n## JSON decoding\n# Threat model\n## Threat model key components\n## Formal definition\n## Threat Surface\n## Threat actors\n## Scenarios\n# FPM\n## Context\n## Audit methodology\n## Findings\n## Configuration\n## Redirection of FPM workers stdout/stderr into main log\n## Shared Memory\n# RFC 1867\n## Context\n## Audit Methodology\n## Findings\n# Redacted security issues\n# PDO\n## Context\n## Audit methodology\n## Findings\n# Native MySQL driver\n## Context\n## Audit methodology\n## Findings","[{\"question\":\"What is the reference and version of this PHP-SRC audit report?\",\"answer\":\"The report reference is 24-07-1730-REP and it is version 1.4, dated 2025/03/14.\"},{\"question\":\"Who collaborated on the PHP-SRC audit?\",\"answer\":\"Quarkslab SAS authored the report in collaboration with Open Source Technology Improvement Fund, Inc., and it references contacts from both OSTIF and PHP Foundation.\"},{\"question\":\"Which PHP components are covered in the audit?\",\"answer\":\"The audit includes cryptography-related scope plus evaluations of PHP-FPM, RFC 1867, PDO, and the native MySQL driver, along with associated findings sections.\"}]","PHP-SRC audit - Version 1.4 - Technical report | PDF",1791930274,37]