PHP disable_functions Is Not a Sandbox
A new PoC bypasses PHP disable_functions on 8.5.12 and 8.4.27. It is a real memory-safety bug and sandbox escape, but not a new CVE-level PHP vulnerability.
November 11, 2026
8 min read