# Quarkslab, OSTIF: what they say

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Quarkslab, OSTIF: 2024 audit that first surfaced the OOM issue; the claims this site attributes to them and their sources.

Party

# Quarkslab, OSTIF

2024 audit that first surfaced the OOM issue

## Claims this site attributes to this party

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory findingThe Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself. [fact timeline →](../../facts/quarkslab-redacted/index.html) | Quarkslab's blog; a Substack analysis | reported | **A6** Established●●●●●● | 1/2 | [Quarkslab](../../sources/quarkslab-blog-php-src-audit/index.html) [David Lopez-Kurtz](../../sources/substack-lopezkurtz-patch-is-the-exploit/index.html) |

## Its sources in the vault
- [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html) The PHP Foundation
- [php2shell by Calif Research — A tale of two PHP remote vulnerabilities](../../sources/calif-php2shell/index.html) Calif (Calif Research)

[Every party →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/actors/quarkslab/index.html