aelius Posted yesterday at 08:26 AM Report Posted yesterday at 08:26 AM Summary On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks At this time, no technical details have been made public. CERT-EU advises organisations to prepare for immediate patching of affected assets. Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. The PHP team has scheduled the release for 21 October 2026 at 14:00 UTC [1]. Technical Details No technical details are currently available for CVE-2026-109618 and CVE-2026-109619, apart from their CVSS scores of 9.2, which indicate the potential for unauthenticated remote code execution Affected Products These vulnerabilities could affect all PHP versions from PHP 5 onwards Recommendations CERT-EU strongly recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available. Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied. Ref: - https://cert.europa.eu/publications/security-advisories/2026-018 - https://www.php.net/index.php#2026-10-20-1 Important: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/ https://jackalsyn.com/posts/php-up-2026.html 3 1 Quote
Nytro Posted yesterday at 08:47 AM Report Posted yesterday at 08:47 AM PHP e secure, nu are vulnerabilitati 1 Quote
aelius Posted yesterday at 08:53 AM Author Report Posted yesterday at 08:53 AM 3 minutes ago, Nytro said: PHP e secure, nu are vulnerabilitati Pai pornind de la stiva tcp/ip; e totul o copturǎ :))) Dar de acolo mancam, nu? 2 Quote
Nytro Posted yesterday at 10:15 AM Report Posted yesterday at 10:15 AM Mancam o paine si noi si agentii ❤️ 2 Quote
sicilianul Posted yesterday at 11:26 AM Report Posted yesterday at 11:26 AM Chiar citeam de dimineata de vulnerabilitatea asta. Nasol moment. E mult pana afla claudiu de el .... Quote
aelius Posted yesterday at 11:41 AM Author Report Posted yesterday at 11:41 AM Distractie mare. Multi si-au oprit pur si simplu site-urile cu totul pana fac update-uri. Quote
Nytro Posted yesterday at 02:04 PM Report Posted yesterday at 02:04 PM debian@vps-78028d34:~$ sudo apt upgrade Upgrading: php8.4-cli php8.4-fpm php8.4-intl php8.4-opcache php8.4-sqlite3 php8.4-xsl php8.4-common php8.4-gd php8.4-mbstring php8.4-readline php8.4-tidy php8.4-zip php8.4-curl php8.4-gmp php8.4-mysql php8.4-snmp php8.4-xml Quote
sicilianul Posted 22 hours ago Report Posted 22 hours ago 6 hours ago, aelius said: Distractie mare. Multi si-au oprit pur si simplu site-urile cu totul pana fac update-uri. Da da am vazut. Si noi am oprit pe la 16:30 si am vazut ca pe la 16:40 au inceput sa vina update-urile. Quote
Cheater Posted 19 hours ago Report Posted 19 hours ago Eh, dai cu cloudflare in fata (+ fw cu allow in from cf ips), si lasi update pe mai tarziu: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ PS: omg, n-am mai intrat de cand eram copil, credeam ca s-a sters contu' 3 Quote
Massaro Posted 1 hour ago Report Posted 1 hour ago (edited) Ce a fost si ce e, inca, PHP. Zicea cineva ca e COBOL-ul web-ului. Ma chinuiam acum un deceniu sa inteleg $_['GET'] si alte cacaturi (inca nu stiu PHP, m-am axat pe python si m-am dus spre sys admin), dar cum au avansat lucrurile de atunci pana acum. Incredibil. TypeScript, framework-uri Next, AI de acum... Pula mea, imi vine sa imi iau doua telefoane d alea vechi sa mi trimit o manea prin infrarosu. Ce trece vremea. Polonic mai e? Ma(-)ta-i grasa inca? Gecko mai traieste? Edited 1 hour ago by Massaro Quote
