They haven't even been able to release the patch on time. Ubuntu still hasn't it

dspillett 4 hours ago | parent | next [-]

Debian has, though only for current stable (updates for oldstable and oldoldstable apparently about to drop) which might imply they had no advanced access to the update so could not pre-test and release immediately upon the coordinated announcement.

	▲	nolok 4 hours ago \| parent [-]
		Sury is up for all versions too

▲

rob 4 hours ago | parent | prev | next [-]

Not true. I was able to `aptitude update` and `aptitude full-upgrade` before 10:00 AM EST (9:50 AM) and received the new php8.* packages and upgraded fine.

▲

cpncrunch 4 hours ago | parent | next [-]

Still no update for ubuntu 20.04 which has support via ESM, even though the patch is available for php 7.4. There are a lot of people using older servers which still have ESM support.

▲

cpncrunch 3 hours ago | parent [-]

Patches have now landed for 20.04 and other earlier Ubuntu versions. https://ubuntu.com/security/CVE-2026-109618#status

	▲	2 hours ago \| parent [-]
		[deleted]

▲

kijin 4 hours ago | parent | prev [-]

Anyone using a non-default version from the semi-official PPA by Ondrej Sury is still waiting for an update.

The launchpad server is throwing 503 errors all over the place, so that's probably the reason for the delay. Sury's own repo has the fixes all right.

	▲	phit_ an hour ago \| parent [-]
		[dead]

▲

hdgvhicv 5 hours ago | parent | prev | next [-]

I had an email from usn recently

▲

unethical_ban 4 hours ago | parent | prev [-]

at 15:00 UTC, spot checking, Debian 13 has a fix, Ubuntu 26.04 has a fix with their own patch version number, Fedora does not.

Ubuntu: https://ubuntu.com/security/notices/USN-8948-1

Fedora package status: https://packages.fedoraproject.org/pkgs/php/php-fpm/

▲

lee_ars 4 hours ago | parent [-]

PHP 8.5.4-0ubuntu1.5 (the fixed version for Ubuntu 26.04) has been downloadable for me via apt from security.ubuntu.com for about 30 minutes. Perhaps check to see that you're not using a different mirror?

	▲	unethical_ban 4 hours ago \| parent [-]
		You're correct, I was looking for the upstream patch number.