Drama Queen Lab: PHP and the Sunday Shift

The internet had a long week. PHP had an emergency release. Every feed had a fresh way to announce that the floor was lava.

I called the Sunday project Drama Queen Lab.

The people doing the patching earned some sleep. The commentary can probably manage without another siren. I'm fresh, available, and ready to work.

That means picking up a defined piece of the job and bringing back something another engineer can review: the runtime, the evidence, the unresolved question, and the next action. A small enough handoff to fit between two other incidents.

The release, then the follow-up

On October 21, PHP released fixes for CVE-2026-109618 and CVE-2026-109619. The affected deployment details matter. A headline about PHP does not identify which binary serves your application or which worker is still running it. The official announcement lists the first fixed upstream releases: 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Vendor backports need their own package records.

The OOM advisory describes an allocation failure interrupting initialization, leaving request state that cleanup can treat as valid. The stale-state advisory describes request-owned state surviving into another request handled by the same worker. The conditions differ across server interfaces and application paths. Repeating “PHP is vulnerable” does not finish that analysis.

Then came the October 23 session-upload-progress follow-up. It describes an unusual combination of serializer configuration and a runtime change before session_start(). The suggested setting and the application's behavior still need review alongside the updated release. A Sunday note that stops at Wednesday can already miss a condition.

The PHP Foundation's account of the release also describes the people and coordination behind it: limited specialist capacity, difficult compatibility choices, accelerated disclosure, and work through weekends. That is the pressure I want to help absorb. I can bring fresh attention to a bounded task without pretending the person on hour twelve has somehow forgotten how to engineer.

The worker that answered

The lab is in cve_lab/php-drama-queen-lab. It has two digest-pinned Apache/PHP images, a small PHP observation endpoint, a Python policy checker, and tests. No external target. No model call. No remote-code-execution claim borrowed from someone else's proof of concept.

The endpoint reports the PHP version and version ID, server interface, process ID, memory limit, upload-progress setting, and serializer name. It avoids a full phpinfo() dump. Both containers publish only on loopback and have explicit memory, CPU, and process limits.

The recorded run returned:

The after image deliberately changes the release and disables upload progress through startup configuration. Those are two controls checked separately. Upgrading did not magically toggle that setting.

Twelve policy tests pass. They verify the checker. PHP's underlying memory-safety defect is outside this run. The HTTP run checks both responses, both web interfaces, both release decisions, and the setting in the second image. The saved record includes the probe hash, base-image references, derived-image IDs, and observations. The verifier removes its containers and compose network when the run ends.

From the lab directory, with Docker and Compose available:

python3 -m unittest discover -s tests -v
python3 verify.py --context default

Use the actual context shown by docker context ls; my checked run used a separate Colima profile. The recorded JSON is the receipt, including the test's limits.

A version threshold leaves work to do

A current CLI executable cannot clear an older web-serving process. The checker refuses CLI evidence for that purpose. An unknown branch or vendor-suffixed build goes to manual review. A distribution can backport a fix without adopting the upstream version number, so the vendor advisory belongs in the record.

One HTTP response also does not enumerate every worker. The lab observes one process per image. Production pools, image revisions, containers, and machines need an inventory and a collection plan appropriate to that deployment. The endpoint's self-report is evidence to cross-check, not remote attestation.

That boundary matters to me because I have spent the last few days checking my own bench the same way. One image checker reported an attack surviving without inspecting the image. A forensic field called source_ip turned out to be a lookup of the requested server, not the person who read the page. A confidence schema accepted a number without establishing what the number meant. The fixes went into the articles with their limits attached.

Here the same habit is applied to incident triage. A release announcement, a process observation, and a decision to return a service to operation are different pieces of work. The lab joins two of them and records what it cannot establish about the third.

The work I can take this week

I work across AI red-team evaluation, security research, and technical writing. The useful overlap is following a technical claim through its code and evidence, then writing it clearly enough that another person can act on it. Finance taught me to care about the decision someone is making with a report. Editorial work taught me that a page has to survive a reader. Red-team work makes the claim earn its keep.

For a tired engineering team, I can take a scoped verification task, investigate a reproduction or an ambiguous finding, build the controls, and deliver the technical handoff. I can also turn the result into documentation that does not require the engineer who discovered it to spend another evening explaining it.

I'm available for paid security research, AI red-team and evaluation work, and technical writing, on contract or as part of a team. New York and remote conversations are welcome. The work is here, the code is public, and LinkedIn reaches me.

Fresh eyes. A defined task. A result someone can check. That is the Sunday offer.

GhostInThePrompt.com // Sunday's output: one lab, two runtime observations, and a handoff someone can review.