>PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.
I get that maintenance teams need to have conviction in this approach, but this is definitely going to cause catastrophically large data breaches downstream.
> Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.
None of these 2 CVEs seem relate to POC spread in twitter. I'm not sure if the POC is something fake or they just unveil something within a few hours..
Scroll down in the actual patches to the weirdness of the multipart parser. That very much looks related to the what can be abused via the upload progress callbacks that had been discussed on (anti)social media.
>PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.
I get that maintenance teams need to have conviction in this approach, but this is definitely going to cause catastrophically large data breaches downstream.
Two bullet points down from where you’re quoting:
> Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.
None of these 2 CVEs seem relate to POC spread in twitter. I'm not sure if the POC is something fake or they just unveil something within a few hours..
Scroll down in the actual patches to the weirdness of the multipart parser. That very much looks related to the what can be abused via the upload progress callbacks that had been discussed on (anti)social media.
I was hoping with the delay nixpkgs would come with a fix.
There aren't even official docker images yet
This is so embarrassing. OCI images could have easily been prepared to be ready for the announcement.
2 replies →
30 minutes later and still waiting
now they're out
Where? Not out yet
Caching. Try adding a query parameter: https://www.php.net/archive/2026.php?a
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.php.net/downloads.php?source=Y
It's really up.
[dead]
[flagged]