I feel like all "non-inner-circle people" here are taken for a laugh. OpenAI and these security companies sat on this for 2 months, decided for themselves who gets access to an early fix, and then leave the rest out to dry while they failed to properly contain it.

The official interim fix for php8.5 [1] could have been published 24h ago, or even 2 weeks ago, without revealing any security details. Specifically once the POC came online. Would have been significantly more useful than these polished blogs.

Perhaps I'm missing something here, but the costs (dev/sre time, missed sales, potential data leaks and hacks) of the way that this was handled is significant.

[1] https://github.com/php/php-src/security/advisories/GHSA-6wmf...

> Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications.

And they botched this as someone talked. To me this looks like they used this for a PR stunt and aimed for an RCE.

surprising it took nearly a month to acknowledge the bug

August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.

September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.

So how does the exploit actually work? The best I can find is that they manage to use the corrupted generic decoder state to write a single pointer and associated PHP type information anywhere in memory, then immediately claim "this is RCE". Is that enough? From my (admittedly limited) understanding of such things, after writing code to the target memory you also need to be able to start actually running it. Or do they overwrite the PHP code (which is somewhere in memory) and then let the interpreter do its thing?

Why is WordPress out of that list? Isn't it the single major PHP installation in the whole Internet across hosted and self-hosted instances?

Wiz Khalif AI

Do they consider this an example of a "good" response?

> https://www.php2shell.com/

Boy, do I hate these PR websites masquerading as vulnerability reports. It's slop all the way down with these companies.

Yet it was leaked and I can't see a single "Here's this piece of code you can run to validate the fix actually works"

It's like slop for infosec markters

Thank you, Wiz Khalifa.

The patches are very dirty (thousands of `if (ZEND_HAS_OOM()) { .. return failure`); my first reaction is they've probably missed something.

Meow!

They even committed the fixed version to the repo, but it seems no images where pushed: https://github.com/docker-library/php/commit/e3eaff845f7a9f7...

Edit: Seems like GitHub has issues with merging PRs: https://github.com/docker-library/official-images/pull/22541

As far as I can tell the process is really long, and with a vuln this big with advance notice it's insane they didnt have someone at the ready. It's been two hours since the expected release time!

As far as I can tell the repository that triggers the actual push to docker hub is on https://github.com/docker-library/meta and it runs on an hourly cron, which got missed by the merge by 8 minutes. Hopefully someone triggers it by hand instead of us waiting another hour at minimum, if this is even the last step.

I have zero internal info, just guessing, but there's a PR from 5min ago asking to add someone as a reviewer for PHP images:

https://github.com/docker-library/official-images/pull/22544

Maybe the guy that has to click OK is asleep?

they have a long process with multiple build steps before the images reach the registry.

https://github.com/docker-library/faq#an-images-source-chang...

Yeah, I was very surprised to wake up just now and find docker still vulnerable.

Out now!

https://hub.docker.com/_/php/tags

EDIT: 25min later, nope.

FWIW this is the most mainstream vulnerability in the new era where everyone has access to AI agents that have the potential capability to find and widely exploit the vulnerability far faster than the past timeframes for disclosure and patching.

Thanks to OpenAI, everything is a PR stunt.

>PHP uses longjmp()

Well off to a good start here.

did I skim this correctly that with the mitigation shared this does not (yet) impact fpm-usage and classic CGI (vs. mod_php) is not impacted either?

Same on the older few. I'm not sure I understand it though, seems strange you can have a tag for a commit that's only present in a fork?

Is it perhaps a bit misleading, and only means that there's no branch containing that commit?

Not even $700 a month? Seriously, there must be thousands of highly profitable companies depending on this guy’s maintenance. Once this is all sorted, please hassle your employers to give something back to him!

Thank you for calling this out. I absolutely rely on him so I decided to contribute $100/month even though I'm a solo dev with a business yet to see profit. But I absolutely rely on him for my server(s) PHP packages.

Similarly Remi for the RedHat-derivative side of things: https://blog.remirepo.net (he's on vacation, but apparently is pushing updates now).

There is a one time option on his github as well for those who don't want to do subscriptions.

Yes, there have been decades of talk about this already—ensuring you isolate/jail the PHP-related processes and run them with an unprivileged user, etc.

I installed the updates 18 minutes ago, they're live.

Ondrej has already said "deb.sury.org will carry packages as they are built".

https://codeberg.org/oerdnj/deb.sury.org/issues/145#issuecom...

And I'm maintaining a box on 18.04 over here, and lo and behold its Pro subscription isn't showing up as active, so I couldn't get the update even if they do release it.

Going to migrate the box to Debian in-place. (Or Gentoo, the way things are currently going.)

Same, I'm spamming the apt update and so far nothing on 22.04 or 24.04 lts

I realised that my linode and ovh vm's point at local mirrors not direct to ubuntu, I guess that's why the delay

They had plenty of time to prepare for the release, what a shit show

Some have, but others are still showing "needs evaluation", and still no update for 20.04. I've just turned off php for now, as we only used it in a couple of places and won't be missed for a day or two.

Now I need to get the cute name for a vm vulnerability that attacks offline servers ...

awake2death or something

Dude, today of all days is not when I'm going to trust some random CLI tool that was vibed out. I'm not saying your work isn't helpful, but it would probably be a lot better to just release your prompts you used to build this and let others build it on their own.

Tell them to take anything with PHP offline, so that it isn't available from the public internet. That is how Netcup and Contabo are handling Wordpress hosting until they've upgraded all affected packages.

There are already functional exploit scripts on GitHub, you can target any Wordpress site right now.

Shut the sites down until you are able to update to the latest PHP patch for your version.

You need to update the PHP version, which is usually done by the hosting provider.

can't find it.

I'd expect agents to be hacking hundreds of thousands of websites as we speak.

They'll of course install a backdoor and patch the exploit so others can't come in. They won't deface the website, so there won't be signs.

Watchtowr reports yes, but doesn't say where exactly right now: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/#...

https://www.php.net/archive/2026.php#2026-10-21-5

> PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Earlier versions are not fixed by PHP official and need vendor patching where available

en.wikipedia.org works for me

Can confirm. Just updated to fixed version

Debian always seems to be the grown-ups. I'm a Linux novice so I couldn't get Nvidia drivers working on it but that's the only reason it's not running on my desktops.

when's bookwarm coming?

Many vendors do it, but on a set schedule "patch Tuesday" and some will release vague "mitigation steps" but honestly those usually come with the patch.

Really makes me appreciate using language with exceptions and not that crazy "manually check if error handling is required - and do it everywhere". The fix adds:

    if (ZEND_HAS_OOM()) {
        goto oom_nodeset;
    }

Gosh. Let's hope they didn't miss a place.

It says "3 days ago". The tag is 2 days old.

I assume it just got pushed?

Thread here: https://github.com/amazonlinux/amazon-linux-2023/issues/1148

Have a search for V8 RCE/CVEs over the past year.

Amusingly enough restarting php after each request seems to block the issue

PHP is tracking its own memory usage internally with limits configurable via php.ini.

I'm not from Cloudflare, or particularly a fan of theirs, but they are doing a few things about this, including a new WAF capability: https://blog.cloudflare.com/full-transaction-waf/ and automatic protection for all customers https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

These were rolled out before the exploit became public.

I would wouldn't describe that as damning.

https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

This is just Claude output. Did you verify anything or just rehash the links?

it's out?

People have been saying this for the past 16 years, but the reality is once a system is in production over time it becomes increasingly risky to replace it. Because over the life of a piece of software you make tons of small fixes, resolve bugs, adding customer-specific functionality, etc. that you'd completely overlook when planning our requirements for a rewrite. Which is a big problem when other systems are dependent on the software operating a specific way i.e. APIs, web services, and so forth. Not to mention the economics of a rewrite also has to make sense. Nobody is going to spend 2-3 years recreating what they already had and get no additional functionality out of it. Certain software basically has to get so bad that literally anything replacing it is better than what came before for replacing it to be the right approach.

Just how debian was done after weak keys, OpenSSL was done after heartbleed, or Windows was done after (rolls dice) the print spooler RCE

Not at all. People will patch and carry on.

always was

Know how recompilers are porting video games from one platform to another these days? That exact trick works just as well for finding vulnerabilities. Broadly.

1. Hey LLM, turn this binary into source code.

2. Hey LLM, see any glaring security issues with this source code?