attestation program

A subtle bug in PHP’s password verification logic — tracked as CVE‑2024‑3096 — let an attacker gain account access in a corner case: if a stored password hash begins with a NUL (0x00) byte, calling password_verify() with a blank password could return true. Microsoft’s Security Response Center...