An important PHP security update [LWN.net]

[Security] Posted May 3, 2012 21:44 UTC (Thu) by corbet PHP 5.3.12 and 5.4.2 have been released to fix a nasty security hole that was disclosed somewhat sooner than planned. Essentially, it allows any remote attacker to pass command-line arguments to the PHP interpreter behind a web page—but only in the (hopefully rare) setups where PHP is invoked via the CGI mechanism. "If you are using Apache mo

[tmatsuu]

PHPをCGI経由で使ってる場合、URLの最後に?-sをつけるとソースが見えてしまう脆弱性。なにそれひどい。5.3.12と5.4.2で修正されてる。早期にアップデートすべし。

[mizchi]

便利！！！