https://www.php.net/manual/en/errorfunc.configuration.php#ini.error-reporting https://www.php.net/manual/en/errorfunc.configuration.php#in... I don't know what

https://www.php.net/manual/en/errorfunc.configuration.php#ini.error-reporting https://www.php.net/manual/en/errorfunc.configuration.php#in... I don't know what their PHP configuration is set to in production. As a rule, I don't test systems that require me to send packets. I only look at code. This keeps me from having to care about the Computer Fraud and Abuse Act. What I know: The particular bit of code that Paul tweeted is vulnerable, and the mitigation you're asking about only reduces it from a "grep the HTTP response body" oracle to a timing oracle, so it doesn't actually eliminate the issue.