Thanks to the surprisingly well working wifi at the moment the slides from the PHP Security pitfalls are now available can be downloaded here. I hope everyone who had been present at the talk had found something interesting that will help them improve the security of their code.

The two tutorials at php|tek went rather well, I am still surprised my voice held up for 6 hours of talking. The slides in PDF form can be found below: Securing PHP Applications PHP & Performance

The PHP 5.2.2 is finally out and can be downloaded at the following URL: http://www.php.net/downloads.php#v5 The release fixes over 120 different bugs in PHP and resolves the majority of MOPB issues identified by Stefan Esser as well as some security bugs that were identified by other security researchers as well as PHP's own developers. You can find out the full details of the changes made via the release announcement as well as the line-by-line changelog. I recommend that all users consider upgrading to this release regardless of the version that they are currently running. However, if you must stay on PHP 4, Derick had released PHP 4.4.7 today as well that contains relevant security fixes.

The 2nd release candidate of PHP 5.2.2 was just released and can be downloaded here: Source Code: http://downloads.php.net/ilia/php-5.2.2RC2.tar.bz2 (md5sum: 4752195cc5418686914ee1db08774763) Win32 Binaries: http://downloads.php.net/edink/php-5.2.2RC2-Win32.zip (md5sum: afa59d4219d83b7281f0101c9dae947e) Since there were no major regressions in RC1 and RC2 only resolved pre-existing issues the goal is to proceed with the final release next Thursday. To make sure that the release is solid and does not break any existing code I would like ask everyone to test it against their code to see if everything still works as expected. If you identify any new issues since 5.2.1, please let me know.

The first release candidate of PHP 5.2.2 is now available for download here: http://downloads.php.net/ilia/php-5.2.2RC1.tar.bz2 (262e36555c083d103259fea165faabaf) http://downloads.php.net/ilia/php-5.2.2RC1.tar.gz (04e979787670d3d5e1c3e289104b65fa) The focus of this release is twofold, number one we are continuing to stabilize the language, with over 60 bug fixes. The second goal was to improve the security of the language through an internal audit as well as by addressing previously unknown bugs identified by MOPB. As you can imagine both these goals result in a rather extensive set of changes, so testing to make sure no new bugs or regressions were introduced is critical. Therefor I would like to ask everyone, over the next few weeks to give this RC a shot with your code base to ensure there are no problems. I want to make 5.2.2 go out as soon as possible given the security improvements that it brings, with the next RC slated at just over 2 weeks from today (April 26th) and the final in early May. I...