|Original author(s)||Stefan Esser|
|Initial release||October 2, 2006|
0.9.38 / May 21, 2015
Suhosin (Korean 수호신, Korean pronunciation: [suɦoɕin], meaning "guardian angel") is an open source patch for PHP and also a PHP extension, written by the German company Sektion Eins. The patch and the extension are two independent parts, that can be used separately or in combination. "The goal behind Suhosin is to be a safety net that protects servers from insecure PHP coding practices."
Suhosin also reduces the "attackable surface" that PHP adds to a Web Server through function whitelists, resource limits, transparent session and cookie encryption, binary content filter, logging and various other protections. This reduces the risk of deploying previously deemed unsafe PHP programs and protects against known and unknown attacks.
While the original patch included several low-level memory-related hardening, those feature aren't present in the modules, but most of them have been upstreamed into PHP.
In some Linux distributions, notably Debian in versions up to 6.x ("Squeeze") and Gentoo Linux, it was shipped by default with both patch and extension. Suhosin was removed from Debian as of version 7 (Wheezy) but reappeared in the current development branch.
It is activated by default in Mac OS X Server.
As of PHP 5.4, openSUSE dropped the Suhosin patch, but maintains a port of the Suhosin extension.
FreeBSD 10.1 maintains the Suhosin extension in its ports collection.
Suhosin was first released in 2006, and targeted PHP 5.2.0. The last release of the hardening patch happened a couple of months after the release of the module. The last news article on the official website is from 2007, and no activity occurred in the code repository from May 2012 until February 2014. This led some distributions to consider the Suhosin project dead, until some people from the community started to contribute back to it, circa 2014. There is no plan to upstream features into PHP.
In November 2015, suhosin7 was created, to provide similar hardening features to PHP7 but failed to gain momentum among the community. The Snuffleupagus project aims at being its successor, for PHP7 and onwards.
Edited: 2021-06-18 14:11:22