@GossiTheDog@cyberplace.social
2026-10-20 19:45 UTC
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
https://www.php.net/archive/2026.php#2026-10-20-1
Replies (1)
-
@GossiTheDog@cyberplace.social 2026-10-20 23:51
A really good mitigation for this btw - AppArmor or SELinux. Google something like apparmor restrict php from executing commands. Works against these CVEs. Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.