Comment by nr378
11 hours ago
Fixed versions have been released slightly early, along with full technical details:
https://www.php.net/archive/2026.php#2026-10-21-5
RCE via OOM corruption - https://github.com/php/php-src/security/advisories/GHSA-w8hw...
RCE via stale global state - https://github.com/php/php-src/security/advisories/GHSA-6wmf...
The PHP Foundation's official writeup of the vulnerability and details about the timelines to disclosure + fix: https://thephp.foundation/blog/2026/10/21/todays-php-securit...
From what has been coming out, this vuln has been known for a while. So they had time to have the patches, etc all prepared, and push everything out.
Still waiting on container updates and package updates. Not a peep from cpanel or plesk. What a mess
cPanel might not have said anything but they have patches available
Yep they just got released 20-30 minutes ago. I'm upgrading clients now
So the proposed mitigations (block multipart forms, disable upload progress) are actually helpful (if not necessarily sufficient).
Fyi updated versions are now available for the Gentoo Linux distribution: https://packages.gentoo.org/packages/dev-lang/php
(I just ran an "emerge --sync" but the mirror that was used does not have yet the updates)
Ubuntu's updates have hit their package archives too:
https://ubuntu.com/security/CVE-2026-109618
Really, all previous PHP versions are affected?
Are there security patches for servers running old versions?
There are so many keeping old php versions alive for compatibility with whatever software
The CVE wasn't clear about the impact and suggested every version after 5. That is going back over a fucking decade, almost two.
There's a lot of zombie software on the net that is ripe for the picking. More food for the botnet.
Wordpress in particular is a stupidly simple vector.
3 replies →
for debian there's https://deb.sury.org/
Ubuntu pro is free for up to 5 machines
PHP 8.1 on Ubuntu 22.04 had the fix backported and released via security.ubuntu.com
There's also this writeup: https://www.wiz.io/blog/php2shell-php-rce
It seems to have a few more technical details.
Also released on Docker Hub now
Are they though?
yep... same issue with 8.2.35-apache.
Docker hub shows the new tags but the manifests are missing https://hub.docker.com/_/php
FreeBSD ports tree has the updates in their git now.
[flagged]
https://news.ycombinator.com/item?id=50180987
[dead] ?
Oh it's been killed by someone?
What does that even mean?
Shit, some people on HN sure don't want any timely mitigations to be available.
How would that work for the OOM cases?
Out of memory?
"If you don't want to be vulnerable just install this vibecode project from a 10 minute old repo someone posted."
Doesn't really feel like it's a good way to handle security to me.
It's not exactly a common situation. This is an emergency for many people. They are vulnerable and unprotected, and UNABLE TO PATCH their PHP... what do you recommend them to do?
This is MIT open source, run it through your own LLM. If you find a bug, submit a fix.
If you're paranoid, launch it as a Linux user with no access to any files. It's just supposed to proxy some network requests.
2 replies →