PHP

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays on the Tier 2 row, which PHP reaches through its OSS-Fuzz integration, for a patch you get accepted upstream and that stays merged, without reverts, for one month. It does not pay for the report. The Tier 2 column runs from $100 for a one-liner to $5,000 for a complicated, high-impact change, and the memory-safety multiplier is Tier 1 only, so it does not apply here. The patch must be at least one month and under twelve months old, it is rate-limited to three submissions a person a month, the maintainers hold a veto, and sanctions and territory exclusions apply. Latest advisories Loading the feed Overview PHP is still the server language of most of the web. WordPress, Drupal, Joomla and Magento all run on it, along with a very long tail of bespoke applications, so a defect in the interpreter is reachable from an ordinary HTTP request against millions of sites at once. The engine is C, it parses attacker-controlled data across a dozen bundled extensions, and it executes on input by design. The interesting bugs are memory corruption in that parsing surface and anything that turns request data into code. The project pays nothing for a report and its security policy offers credit through the MITRE Credit System, so sorona.xyz pays you directly on a qualified, reproduced finding. In scope SECURITY.md directs reports to GitHub private vulnerability reporting on php/php-src , against a supported release line. The whole interpreter tree sits inside that The Zend engine as a whole, including the compiler, the executor, the allocator and the garbage collector, and any use-after-free reachable from ordinary userland code Object deserialization through unserialize() and the phar stream wrapper, where attacker-controlled bytes drive object construction and destructor chains Every bundled extension that parses untrusted data, including GD and EXIF on uploaded images, zip and tar handling, the libxml-backed parsers, mbstring, intl and the date parsers Stream wrappers and filters in full, covering phar://, data:// and the network wrappers, and anything that lets a filename argument reach a protocol handler the application never intended The SAPI layer across all four SAPIs, especially php-fpm and CGI parameter handling, where request metadata from the web server crosses into interpreter state Opcache and the compiled-code cache, where one request's compiled state can be served to another, including across virtual hosts on a shared FPM pool The standard library, particularly filesystem and path handling, including null-byte and normalisation differences that let a validation check and the eventual syscall disagree Out of scope Vulnerabilities in applications and frameworks written in PHP such as WordPress, Drupal and Laravel, rather than in php-src; those have their own programmes Third-party PECL extensions that are not carried in the php-src tree Application-side misuse of intentionally dangerous functions: passing request data to eval, include, system or unserialize and reporting the consequence Web server or FPM pool misconfiguration rather than a defect in the interpreter One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, including crashes that come from resource exhaustion Patches the maintainers decline, patches under one month or over twelve months old, and anything past three submissions a person a month Most-valued findings Memory corruption in the engine or a bundled parsing extension reachable from ordinary request data, which is the top bug class here at 38% and the class the Patch Rewards ceiling exists for An unserialize() or phar-driven object-injection path that reaches code execution without the application doing anything obviously wrong A stream-wrapper or path-handling flaw that turns a filename an application validated into a different file or a different protocol at the syscall Cross-request or cross-tenant state leakage through opcache or the FPM worker lifecycle, which breaks the isolation shared hosting depends on A systemic hardening patch that removes a whole class of engine or extension memory bugs rather than one instance. That is what the top of the Patch Rewards scale is written for, and one-liner crash fixes are explicitly excluded from it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately through GitHub's private vulnerability reporting on php/php-src as SECURITY.md directs, with a detailed reproduction; an unreproducible report is not eligible Show the bug on a supported PHP release line, and say which SAPI you triggered it through: CLI, FPM, CGI or the Apache module Expect credit rather than cash from the project itself: its policy offers a contributor credit reflected in the MITRE Credit System, nothing more Give the security team room to ship the fix in a scheduled release before any public writeup The Google patch money is a separate pathway: you land the fix upstream yourself and keep it merged, without reverts, for one month, and at Tier 2 there is no memory-safety multiplier Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated privately with the PHP security team through a GitHub security advisory on php-src. Fixes are batched into the scheduled point releases across supported branches and the advisory names the reporter; hold the detail until the release that carries the fix is out. Nothing in the Patch Rewards rules restricts who may help you prepare or route the report. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability