Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
3 Boosts
0 Likes
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
2 media files
@GossiTheDog Happily, we do have apparmor already running, so thanks for the mini profile.
(I also have an alarm set up for a Fuck You Assholes three hour early wakeup to stagger over to a console in time for the patch drops. But, well.)
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
https://www.php.net/archive/2026.php#2026-10-20-1
PHP: News Archive - 2026