@elise@fedi.katze.sh How is this triggered? Malicious code? Malicious data into benign code? Remotely? (asking because the former, 'malicious code causing UAF' is explicitly not considered as a security bug by PHP folks [1]) [1] https://github.com/php/php-src/security#classification