---
id: 9310
title: "PHP Development Server <= 7.4.21 - Remote Source Disclosure"
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/php-http-server-source-disclosure"
published_at: "2023-01-28T21:07:36Z"
tags: ["bug-bounty"]
phying_url: "https://phying.com/item/9310"
lang: en
---

# PHP Development Server <= 7.4.21 - Remote Source Disclosure

## Summary

Introduction While testing request pipelining on multiple programming language built-in servers, we observed strange behavior with PHP’s. As we delved deeper, we discovered a security bug in PHP that could expose the source code of PHP files as if they were static files rather than executing them as intended. Upon further testing, we found that the vulnerability was not present in the latest PHP release. We conducted further tests on different versions of PHP to determine when the bug was fixe

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **Published:** 2023-01-28T21:07:36Z
- **Original:** https://projectdiscovery.io/blog/php-http-server-source-disclosure
- **Phying News:** https://phying.com/item/9310