Re: From mono-implementation risk to spec: Lessons from CVE-2026-109618/109619 and a path to K/Redex semantics[Idea]

On Sat, Oct 24, 2026, at 22:59, Brian Nguyen wrote: > PHP today has no formal specification. As the KPHP work > (Filaretti et al., ECOOP'14) notes, Zend is the de-facto > spec. That makes this class of bug hard to catch: > ... > I am proposing we use this incident to start: > > A) Formalize Zend bytecode and parser as a living spec > B) Reference executable semantics in two formal frameworks: I think PHP is not starved for bugs. The bottleneck is bugfixes. As I understand it the problems leading to these CVEs were already found by an earlier security test, but the problem was coming up with a good fix. I think creating a spec and a second implementation is not the most efficient way to find and solve bugs. Regards, Sjoerd Langkemper