Re: Should I report this bug/exploit?

Such issues should be directed to security@php.net Mark Krenz wrote:

Hi, I've been using PHP for a long time and have recently found a couple of major bugs that would allow pretty much any user on a shared web hosting server to read other user's files. The conditions for this exploit are quite common. Also, from what I can tell, this exploit would not be very easy to fix and in fact may not be fixable until a peruser MPM for Apache is completely ready (Like perchild or Metux). It could be that you already know about this problem but have also not reported it. I couldn't find any other information about it from doing some searches. This leads me to wonder, is it a good idea to make this vulnerability known? On the one hand, releasing the information would allow admins and developers to try to fix it, but on the other hand, if its not immediately fixable it would allow for a large window of opportunity for attacks. Thus, I came to this list for some advice on what I should do. Maybe I could at least email one of your privately so that you can see what it is. Thanks, Mark