New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an upcoming security release.
It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
Full details, affected versions, and the fixed versions will be published with the release.
Thank you for helping us keep PHP secure.
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
Comments
php deadpool
Well well well
https://x.com/k_firsov/status/2112641845926989944
PHP getting me up early so I can be ready to patch at 7am local...
prob some motherfucking RCE
Looks like mod_php RCE.
https://x.com/k_firsov/status/2112641845926989944
Use quote format next time please.
It's called php2shell.
fyi:
add
session.upload_progress.enabled = Offto your php.ini.it'll fix it.
Any real source? I can't find any past a few people who asked Grok on X and posted Grok's suggestion.
https://x.com/its5q/status/2112700519261032497/photo/1
And: https://x.com/J4ck3LSyN/status/2112703096443097263
So, the exploit is in the wild more or less 12h+ before the embargo ends? neat.
@PulsedMedia
It seems so. All this CVDs are joke when AI exists.
Fix:
session.upload_progress.enabled = Off
https://x.com/RadicDavydov/status/2112703503470825904
Source, affected PHP versions, exact lines causing the issue:
https://x.com/RadicDavydov/status/2112717944455135580
Can confirm this works on PHP-FPM
So How can I be safe
Time to touch some grass?
WAF rules for additional security:
https://x.com/RadicDavydov/status/2112744227553648737
when AI found zeroday exploit suddenly its not a slop
Thank you - do we know already if this fixes both bugs?
I’m tired man…
This… the root ca…
I’m so tired…
Fucking fuck what a start into the day
Good time to make sure your private opnsense is not available to the internet
You cannot be safe. Yes, it is always good to touch grass, much better than sitting here.
Have a rest.
... fuck
always fascinating that you start yapping about something and then do fuck all just for people having to figure out wtf is going on. I hope next time they keep their piehole shut and just patch it and then say something afterwards
PHP core maintainer says this is insufficient https://phpc.social/@Girgias/117476477429221001
Mhm, maybe this (session upload progress OFF) does not solve problem 100%, but definitely makes exploitation a lot harder / less automatable. Plus, such vuln requires specific code on server side. Nowadays all uploads are via AJAX, very rare and old instances use session for upload progress tracking.
Stay calm, you are not that relevant to attract any attention.
i think we have forgotten the age of the clanker. Nobody spends any time on anything anymore when its automated. Given that they show wordpress in that one video, its gonna be glorious
https://news.ycombinator.com/item?id=50172041