PHP Just Patched A Bug That's Over Two Decades Old
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: PHP Just Patched A Bug That’s Over Two Decades Old · Channel: Better Stack · 01:31 · Watch on YouTube
Topics: Cybersecurity and software security, Software engineering with AI, AI developer tools
Summary
Section titled “Summary”PHP had a bug that could send authorization headers to a different server when following redirects, including redirects from HTTPS to HTTP. A patch released in 2026 drops authorization and cookie headers when a redirect changes the scheme, host, or port. Custom headers such as X-API-Key are not covered, so the video recommends disabling automatic redirects and checking the destination yourself. The video also advises updating PHP to a latest patch release from versions 8.2 through 8.5, and briefly praises Laravel and PHP’s staying power.
Key points
Section titled “Key points”- PHP’s file_get_contents could forward authorization headers when following redirects.
- The issue could expose tokens over an unencrypted HTTP connection.
- The bug had existed since 2003.
- The 2026 patch drops authorization and cookie headers if a redirect changes the scheme, host, or port.
- Laravel’s HTTP client uses Guzzle, which handles redirects itself.
- The PHP fix does not strip custom headers such as X-API-Key.
- For custom-header protection, disable automatic redirects and inspect each destination before following it.
- The video recommends updating to the latest patch release for PHP versions 8.2 through 8.5.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | The redirect vulnerability | The video explains how PHP could forward authorization headers to another server, even over plain HTTP. |
| 00:30 | What the patch fixes—and what it does not | The patch strips authorization and cookie headers when key redirect details change, but custom headers still require manual redirect handling. |
| 01:01 | Updating PHP and final thoughts | The video recommends updating PHP and closes with reflections on PHP, Laravel, and the creator’s early experience with the language. |
Quotes
Section titled “Quotes”PHP has been secretly leaking your authorization headers for over two decades. — 00:00
If the scheme, host, or port changes, PHP now drops your authorization and cookie headers before it follows. — 00:30
an API key in a custom header like X-API-Key still goes to the new server. — 00:30
it’s that language everyone’s been saying is going to be dead for the last 20 years, and it just keeps on going. — 01:01
Concepts and entities
Section titled “Concepts and entities”PHP, file_get_contents, Laravel, Guzzle, X-API-Key, Better Stack, XAMPP, LAMP
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 PHP has been secretly leaking your authorization headers for over two decades. Let me explain. Say you want to get the contents of a URL, so you call file_get_contents and pass in your authorization header. If that API redirects to a different server, PHP follows it and sends your token there, too. It even does this if the redirect is from HTTPS to plain HTTP, so your token goes out completely unencrypted. This issue has existed in PHP since 2003, but the new patch released in 20
00:30 26 finally checks where every redirect goes. If the scheme, host, or port changes, PHP now drops your authorization and cookie headers before it follows. And if you’re using Laravel’s HTTP client, you’re fine because it’s built on top of Guzzle, and Guzzle follows redirects itself. But the official fix in the base PHP only strips those specific headers, authorization and cookies. So, an API key in a custom header like X-API-Key still goes to the new server. For that, switch off PHP’s automatic redirects and follow them
01:01 yourself once you’ve checked where they actually point. To get the fix, you just need to update to the latest patch release for PHP, which is 8.2 through to 8.5. And look, I know it’s fun to hate on PHP, and yes, it’s had many problems in the past, but it’s that language everyone’s been saying is going to be dead for the last 20 years, and it just keeps on going. Particularly, I’ve been a massive fan of Laravel, definitely a solid framework that can still build pretty good quality apps. I actually remember using PHP and XAMPP server to run like little websites on my beige computer back when I was a kid, telling
01:31 everyone I was a LAMP stack developer. But anyway, if you want to stay up to date with developer news like this, then subscribe to Better Stack.