Fixed versions have been released slightly early, along with full technical deta...

jamietanna · 2026-10-21T15:51:46 1792597906

The PHP Foundation's official writeup of the vulnerability and details about the timelines to disclosure + fix: https://thephp.foundation/blog/2026/10/21/todays-php-securit...

headinthesky · 2026-10-21T15:20:15 1792596015

From what has been coming out, this vuln has been known for a while. So they had time to have the patches, etc all prepared, and push everything out.

Still waiting on container updates and package updates. Not a peep from cpanel or plesk. What a mess

00deadbeef · 2026-10-21T16:53:24 1792601604

cPanel might not have said anything but they have patches available

headinthesky · 2026-10-21T17:00:32 1792602032

Yep they just got released 20-30 minutes ago. I'm upgrading clients now

elyobo · 2026-10-21T14:16:16 1792592176

So the proposed mitigations (block multipart forms, disable upload progress) are actually helpful (if not necessarily sufficient).

dvdkon · 2026-10-21T14:29:38 1792592978

There's also this writeup: https://www.wiz.io/blog/php2shell-php-rce

It seems to have a few more technical details.

codethief · 2026-10-21T13:59:38 1792591178

Really, all previous PHP versions are affected?

whycome · 2026-10-21T14:13:28 1792592008

Are there security patches for servers running old versions?

There are so many keeping old php versions alive for compatibility with whatever software

ljm · 2026-10-21T15:11:12 1792595472

The CVE wasn't clear about the impact and suggested every version after 5. That is going back over a fucking decade, almost two.

There's a lot of zombie software on the net that is ripe for the picking. More food for the botnet.

Wordpress in particular is a stupidly simple vector.

ashkankiani · 2026-10-21T15:46:54 1792597614

At this point, it would be fastest/most effective for the PHP foundation to deploy their own white-hat mass hacking attack to exploit the vulnerability and forcefully shutdown vulnerable servers.

I can't think of a faster way to clear out the vulnerable surface area.

ishouldbework · 2026-10-21T17:12:22 1792602742

Fastest, most effective and also illegal. Unless you use AI to do it I guess, then it is fine to hack people.

ashkankiani · 2026-10-21T17:17:25 1792603045

Yeah they should poorly set up a sandbox and ask it to fix all the vulnerable servers with the remote RCE and prepare to be surprised when it escapes the sandbox.

szopin · 2026-10-21T14:15:40 1792592140

for debian there's https://deb.sury.org/

jeremyt · 2026-10-21T14:20:44 1792592444

Ubuntu pro is free for up to 5 machines

kassner · 2026-10-21T15:08:44 1792595324

PHP 8.1 on Ubuntu 22.04 had the fix backported and released via security.ubuntu.com

dzhiurgis · 2026-10-22T09:10:19 1792660219

> There are so many keeping old php versions alive for compatibility with whatever software

If only there was a way to trivially rewrite just about any software

zepearl · 2026-10-21T14:14:27 1792592067

Fyi updated versions are now available for the Gentoo Linux distribution: https://packages.gentoo.org/packages/dev-lang/php

(I just ran an "emerge --sync" but the mirror that was used does not have yet the updates)

wiredfool · 2026-10-21T15:34:14 1792596854

Ubuntu's updates have hit their package archives too:

https://ubuntu.com/security/CVE-2026-109618

1over137 · 2026-10-21T16:47:17 1792601237

FreeBSD ports tree has the updates in their git now.

linobino1 · 2026-10-21T15:55:18 1792598118

Also released on Docker Hub now

drrotmos · 2026-10-21T16:00:33 1792598433

Are they though?

  $ docker pull php:8.4.27
  8.4.27: Pulling from library/php
  no matching manifest for linux/arm64/v8 in the manifest list entries
  
  $ docker pull --platform linux/amd64 php:8.4.27
  8.4.27: Pulling from library/php
  no matching manifest for linux/amd64 in the manifest list entries

linobino1 · 2026-10-21T16:05:10 1792598710

yep... same issue with 8.2.35-apache.

Docker hub shows the new tags but the manifests are missing https://hub.docker.com/_/php

2026-10-21T13:53:27 1792590807

[flagged]

SomeUserName432 · 2026-10-21T13:57:30 1792591050

https://news.ycombinator.com/item?id=50180987

[dead] ?

EGreg · 2026-10-21T14:24:40 1792592680

Oh it's been killed by someone?

What does that even mean?

Shit, some people on HN sure don't want any timely mitigations to be available.

mjmas · 2026-10-21T13:59:31 1792591171

How would that work for the OOM cases?

EGreg · 2026-10-21T14:33:41 1792593221

Out of memory?

mjmas · 2026-10-22T06:02:31 1792648951

out of per-request-limited memory. That was part of the vulnerability that the state wasn't completely reset properly.

wickedsight · 2026-10-21T14:00:19 1792591219

"If you don't want to be vulnerable just install this vibecode project from a 10 minute old repo someone posted."

Doesn't really feel like it's a good way to handle security to me.

EGreg · 2026-10-21T14:25:54 1792592754

It's not exactly a common situation. This is an emergency for many people. They are vulnerable and unprotected, and UNABLE TO PATCH their PHP... what do you recommend them to do?

This is MIT open source, run it through your own LLM. If you find a bug, submit a fix.

If you're paranoid, launch it as a Linux user with no access to any files. It's just supposed to proxy some network requests.

pinum · 2026-10-21T15:00:09 1792594809

>what do you recommend them to do?

Shut down the affected services until they can install the patch. This issue is widespread enough that users will understand. Many government etc sites are affected too.

wickedsight · 2026-10-21T14:37:31 1792593451

People unable to patch PHP probably aren't the same people who can be trusted to audit every piece of open source code they interact with. Even in the advent of AI.

I'm sure you have the best intentions. I still think anyone trying to fix a massive security hole by running random 10 minute old code from Github isn't really being smart about it.