Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · discovery · reported
Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding
The Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself.
Fact-check
A6 Established●●●●●● · Count · verdict: holds · the status word understates the evidence
Counted from the captured Quarkslab page: 2 high, 6 medium, 9 low and 10 informative issues (27 rows), with HIGH-1 and MED-2 redacted and the stated reason 'Fixes are complex and in progress.' No row describes an out-of-memory finding. The Substack piece says the same. The Foundation note is carried.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| quarkslab-blog-php-src-audit | carries | two security issues currently redacted while PHP maintainers are actively working on the fixes. Details will be provided after fixes are applied | cd5ccdaf99da0be1 |
| substack-lopezkurtz-patch-is-the-exploit | carries | lists 27 findings, two of them redacted because their fixes were “complex and in progress”; it does not describe an out-of-memory finding. | cb3714dc12f96c96 |
| php-foundation-blog-security-release | carries | While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem | a1be057adc1c5bfa |
Open tickets: Finding-95.
Graded in Run-1, resting on captures up to 2026-10-22 11:31 UTC. The scale is on the fact-check page.
This fact over time
- 2025-04-10Quarkslab publishes Security audit of PHP-SRC - Quarkslab's blog
- 2026-10-22 11:30 UTCSaved into the evidence vault: Quarkslab
- 2026-10-22 11:31 UTCSaved into the evidence vault: David Lopez-Kurtz
- 2026-10-22Enters this site as reported in v0.2.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.2.0 · 22 October 2026 · reported
Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding Who says it: Quarkslab's blog; a Substack analysis Status: reported Topic: discovery Sources: quarkslab-blog-php-src-audit, substack-lopezkurtz-patch-is-the-exploit