# Quarkslab, OSTIF: what they say

Quarkslab, OSTIF: 2024 audit that first surfaced the OOM issue; the claims this site attributes to them and their sources.

Party

# Quarkslab, OSTIF

2024 audit that first surfaced the OOM issue

## Claims this site attributes to this party

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory findingThe Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself. | Quarkslab's blog; a Substack analysis | reported | 1/2 | [Quarkslab](../../sources/quarkslab-blog-php-src-audit/index.html) [David Lopez-Kurtz](../../sources/substack-lopezkurtz-patch-is-the-exploit/index.html) |

## Its sources in the vault
- [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html) The PHP Foundation
- [php2shell by Calif Research — A tale of two PHP remote vulnerabilities](../../sources/calif-php2shell/index.html) Calif (Calif Research)

[Every party →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/actors/quarkslab/index.html