HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
php
php-src
C2009–2026
php / php-src

php-src

The PHP Interpreter

Languages & Compilers
Explore on GitHubRead Hacker News discussions
101Distinct people
124Mentions
1Explicit recommenders
41.8KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

The PHP Interpreter

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

Came here to say this. Configuring php.ini is actually fun for me. I love reading through everything in the file and often end up learning new stuff! For those who've never…

notRobot used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year124 dated mentions

Observed mentions: 2009-07-24 02:32:32 UTC to 2026-10-29 15:59:18 UTC.

051015202009-01-01 00:00:00 UTC to 2010-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20092010-01-01 00:00:00 UTC to 2011-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2011-01-01 00:00:00 UTC to 2012-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 15 mentions; 5 submissions, 10 comments2013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 10 mentions; 2 submissions, 8 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 8 mentions; 0 submissions, 8 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 8 mentions; 3 submissions, 5 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 5 mentions; 2 submissions, 3 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 15 mentions; 2 submissions, 13 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 10 mentions; 3 submissions, 7 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 8 mentions; 1 submissions, 7 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 21 mentions; 6 submissions, 15 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20092009-01-01 00:00:00 UTC2010-01-01 00:00:00 UTC110
20102010-01-01 00:00:00 UTC2011-01-01 00:00:00 UTC000
20112011-01-01 00:00:00 UTC2012-01-01 00:00:00 UTC202
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC15510
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC1028
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC808
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC835
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC413
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC101
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC514
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC523
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC15213
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC1037
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC514
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC817
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC505
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC101
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC21615

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
The PHP Interpreter PHP is a popular general-purpose scripting language that is especially suited to web development. Fast, flexible and pragmatic, PHP powers everything from your blog to the most popular websites in the world. PHP is distributed under the Modified BSD License (SPDX-License-Identifier: BSD-3-Clause). Documentation The PHP manual is available at php.net/docs. Installation Prebuilt packages and binaries Prebuilt packages and binaries can be used to get up and running fast with PHP. For Windows, the PHP binaries can be obtained from windows.php.net. After extracting the archive the *.exe files are ready to use. For other systems, see the installation chapter. Building PHP source code For Windows, see Build your own PHP on Windows. For a minimal PHP build from Git, you will need autoconf, bison, and re2c. For a default build, you will additionally need libxml2 and libsqlite3. On Ubuntu, you can install these using: sudo apt install -y pkg-config build-essential autoconf bison re2c libxml2-dev libsqlite3-dev On Fedora, you can install these using: sudo dnf install re2c bison autoconf make ccache libxml2-devel sqlite-devel On MacOS, you can install these using brew: brew install autoconf bison re2c libiconv libxml2 sqlite or with MacPorts: sudo port install autoconf bison re2c libiconv libxml2 sqlite3 Generate configure: ./buildconf Configure your build. --enable-debug is recommended for development, see ./configure --help for a full list of options. # For development ./configure --enable-debug # For production ./configure Build PHP. To speed up the build, specify the maximum number of jobs using the -j argument: make -j4 The number of jobs should usually match the number of available cores, which can be determined using nproc. Testing PHP source code PHP ships with an extensive test suite, the command make test is used after successful compilation of the sources to run this test suite. Tests run in parallel by default, using up to 10 detected logical processors. Set -jN in TEST_PHP_ARGS or TESTS to override the worker count: make TEST_PHP_ARGS=-j4 test This runs make test with a maximum of 4 concurrent jobs. Alternatively, use -j1 to run tests sequentially. Use the TEST_PHP_ARGS or TESTS variable to test only specific directories: make TESTS=tests/lang/ test The qa.php.net site provides more detailed info about testing and quality assurance. Installing PHP built from source After a successful build (and test), PHP may be installed with: make install Depending on your permissions and prefix, make install may need superuser permissions. PHP extensions Extensions provide additional functionality on top of PHP. PHP consists of many essential bundled extensions. Additional extensions can be found on the PIE Extensions list, and installed with 🥧 PIE, the PHP Installer for Extensions or the deprecated PHP Extension Community Library - PECL. Contributing The PHP source code is located in the Git repository at github.com/php/php-src. Contributions are most welcome by forking the repository and sending a pull request. Discussions are done on GitHub, but depending on the topic can also be relayed to the official PHP developer mailing list internals@lists.php.net. New features require an RFC and must be accepted by the developers. See Request for comments - RFC and Voting on PHP features for more information on the process. Bug fixes don't require an RFC. If the bug has a GitHub issue, reference it in the commit message using GH-NNNNNN. Use #NNNNNN for tickets in the old bugs.php.net bug tracker. Fix GH-7815: php_uname doesn't recognise latest Windows versions Fix #55371: get_magic_quotes_gpc() throws deprecation warning See Git workflow for details on how pull requests are merged. Guidelines for contributors See further documents in the repository for more information on how to contribute: Contributing to PHP PHP coding standards Internal documentation Mailing list rules PHP release process Credits For the list of people who've put work into PHP, please see the PHP credits page.
Read the full README on GitHub

What Hacker News says

21 sources
bell-cot·Oct 29, 2026
I'd suggest reading https://github.com/php/php-src/blob/master/php.ini-productio..., then doing a web search for "editing php.ini for maximum security". Maybe compare with https://github.com/php/php-src/blob/master/php.ini-developme..., too. Then similar for your web server (Apache, nginx, whatever). EDIT: About your "would've seemed adequate before this" - I dug up a copy of a PHP v5.2 php.ini file (2-ish decades ago). That file begins thus: ;;;;;;;;;;; ; WARNING ; ;;;;;;;;;;; ; This is the default settings file for new PHP installations. ; By default, PHP installs itself with a configuration suitable for ; development purposes, and *NOT* for production purposes. ; For several security-oriented considerations that should be taken ; before going online with your site, please consult php.ini-recommended ; and h
Read the rest
ttp://php.net/manual/en/security.php.
In Chained PHP2Shell exploit roots 25 servers, including US Government servers
account42·Oct 22, 2026
Yes and in general lots of users being on unsupported releases should also cause som reflection why that is. E.g. maybe support periods are too short or there are too many breaking changes with new releases. It looksl ike they released official patches at least for 7.4 though: > Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor. https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-...
In PHP 8.2.35
mirashii·Oct 21, 2026
I'm going to engage only because I do not wish others to come across this project and think it's serious. I did open the project and read the code, and I did throw it into an LLM as I previously said for some very basic security posture checks, and found a number problems immediately, but I don't trust them (and neither should you, which is part of the problem here), so I went digging a bit deeper. I don't have the time to go through all of them, so here's a big one of my own finding: There's a parser differential in how multipart boundaries are handled, your proxy only deals with ;, the PHP interpreter accepts , as well, and the proxy will pass it through unchanged to the upstream. That's a full bypass of what the proxy is trying to do. https://github.com/Qbix/proxy/blob/main/src/sanitize.c#L41 https://github.com/php/php-src/blob/master/
Read the rest
main/SAPI.c#L162 The article linked from your own README (https://sansec.io/research/php2shell) has a better partial mitigation in existing, battle-tested reverse proxies. Even still, as that article says, everything here is a partial mitigation. The description of the issues in your project's README is an inaccurate understatement of the severity of the issues. "CVE-2026-109618 — heap use-after-free in the session.upload_progress handler" is an incomplete understatement of the issue, the session.upload_progress handler is only one of a number of potential exploitation paths. https://github.com/php/php-src/security/advisories/GHSA-w8hw... has some hints at other paths, of which there are many. From an LLM, and quickly validated by me, a heap overflow, likely an RCE. > src/http.c:101-116 and src/util.c:9 Attacker supplied value in strtoul, the size-limit checks are unsigned addition that can wrap, and you can follow the chain from there. > or better yet submit a request. This project is not deserving of fixing, it should just be deleted and direct people to more serious documentation of fixes and mitigations. This code is clearly AI-generated slop, it is not my responsibility to fix your project. > I could understand if you actually at least clicked and looked at the repository, and read what it’s about. But you chose to simply write generic text without looking at anything. You want to discourage people from protecting their servers, in order to feel good about yourself. What amount of effort have you put into understanding what you’re even talking about? Every accusation is an admission.
In PHP 8.2.35
codedokode·Oct 21, 2026
I actually looked through PHP code responsible for parsing POST request body and it's pretty bad [1]. First, there is a huge function, that is hard to read and reason about. Second, instead of proper parsing of "Content-Type" header to extract "boundary" parameter, there is just a set of substring searches which is not correct. It doesn't mean there is a vulnerability but it means PHP can read the header in a way different from a standard-compliant implementation (such as web server, WAF etc). [1] https://github.com/php/php-src/blob/master/main/rfc1867.c#L7...
In Security advisory: Critical remote code execution vulnerabilities, update now
esquire_900·Oct 21, 2026
I feel like all "non-inner-circle people" here are taken for a laugh. OpenAI and these security companies sat on this for 2 months, decided for themselves who gets access to an early fix, and then leave the rest out to dry while they failed to properly contain it. The official interim fix for php8.5 [1] could have been published 24h ago, or even 2 weeks ago, without revealing any security details. Specifically once the POC came online. Would have been significantly more useful than these polished blogs. Perhaps I'm missing something here, but the costs (dev/sre time, missed sales, potential data leaks and hacks) of the way that this was handled is significant. [1] https://github.com/php/php-src/security/advisories/GHSA-6wmf...
In PHP 8.2.35

Showing the 15 most recent of 21 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.