Hacker News Reader

Comment by klausa | Hacker News Reader

The patches are out: https://www.php.net/archive/2026.php#2026-10-21-5

>PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.

I get that maintenance teams need to have conviction in this approach, but this is definitely going to cause catastrophically large data breaches downstream.

Two bullet points down from where you’re quoting:

> Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.

None of these 2 CVEs seem relate to POC spread in twitter. I'm not sure if the POC is something fake or they just unveil something within a few hours..

Scroll down in the actual patches to the weirdness of the multipart parser. That very much looks related to the what can be abused via the upload progress callbacks that had been discussed on (anti)social media.

I was hoping with the delay nixpkgs would come with a fix.

There aren't even official docker images yet

This is so embarrassing. OCI images could have easily been prepared to be ready for the announcement.

https://hub.docker.com/_/php are the "official docker" php images not the "official php" docker images, which afaik do not exist.

Ah ok fair enough.

30 minutes later and still waiting

now they're out

Where? Not out yet

https://www.php.net/archive/2026.php#2026-10-21-5

https://www.php.net/downloads.php?source=Y

It's really up.

Caching. Try adding a query parameter: https://www.php.net/archive/2026.php?a

Reply on news.ycombinator.com