Re: Mailing list for future vulnerabilities??

The php-announce mailing list (listed first at php.net/mailing-lists) is for announcing new releases, both for security and general update reasons. You should also look at http://www.phpadvisory.com/ for security news on PHP and PHP applications. Goba [one webmaster@php.net] > I blanched when I just happened by your site and saw the vulnerability that > version 4.2.2 addresses. As a user of PHP in a production web environment, > (which will soon have credit card data on it) I was upset that I was not > made aware of this vulnerability sooner. > > I immediately upgraded my system, but I was wondering if there is a mailing > list exclusively for alerting people to security vulnerabilities or similar > urgent issues. > > As we are a small shop, I do not have time to wade through the regular > mailing PHP lists every day in the off chance there is a security bulletin. > I am a strong proponent of open source software, but it is hard to make a > business case for PHP if you can't expect to be alerted to vulnerabilities > as they are discovered. > > If a security mailing list exists, please let me know. If not, I would > strongly suggest that you take a cue from our friends at M$ and set > something up! (And put links to it in your vulnerability announcements.) > > Thank you very much, > -Bob > >