Post #4212314

RE: https://phpc.social/@sebastian/117001358342074524 Nice write-up! To qualify a little: the original code already had a LOT of guardrails against exactly this situation. Those guardrails just failed to guard against a few exotic callback formats, which are very rarely used to begin with and even rarer to encounter in array keys. To be honest, I was flabbergasted that PHP even supported the callback format mentioned in the CVE and I'm not sure it even _should_ be supported by PHP. But as it is, the tool should be - and has been - fixed.