Hacker News Reader

Hacker News

Comment by nr378 | Hacker News Reader

Full thread

nr378

Fixed versions have been released slightly early, along with full technical details:

https://www.php.net/archive/2026.php#2026-10-21-5

RCE via OOM corruption - https://github.com/php/php-src/security/advisories/GHSA-w8hw...

RCE via stale global state - https://github.com/php/php-src/security/advisories/GHSA-6wmf...

View on HN

The PHP Foundation's official writeup of the vulnerability and details about the timelines to disclosure + fix: https://thephp.foundation/blog/2026/10/21/todays-php-securit...

From what has been coming out, this vuln has been known for a while. So they had time to have the patches, etc all prepared, and push everything out.

Still waiting on container updates and package updates. Not a peep from cpanel or plesk. What a mess

cPanel might not have said anything but they have patches available

Yep they just got released 20-30 minutes ago. I'm upgrading clients now

So the proposed mitigations (block multipart forms, disable upload progress) are actually helpful (if not necessarily sufficient).

There's also this writeup: https://www.wiz.io/blog/php2shell-php-rce

It seems to have a few more technical details.

Really, all previous PHP versions are affected?

Are there security patches for servers running old versions?

There are so many keeping old php versions alive for compatibility with whatever software

for debian there's https://deb.sury.org/

Ubuntu pro is free for up to 5 machines

PHP 8.1 on Ubuntu 22.04 had the fix backported and released via security.ubuntu.com

The CVE wasn't clear about the impact and suggested every version after 5. That is going back over a fucking decade, almost two.

There's a lot of zombie software on the net that is ripe for the picking. More food for the botnet.

Wordpress in particular is a stupidly simple vector.

At this point, it would be fastest/most effective for the PHP foundation to deploy their own white-hat mass hacking attack to exploit the vulnerability and forcefully shutdown vulnerable servers.

I can't think of a faster way to clear out the vulnerable surface area.

Fastest, most effective and also illegal. Unless you use AI to do it I guess, then it is fine to hack people.

Yeah they should poorly set up a sandbox and ask it to fix all the vulnerable servers with the remote RCE and prepare to be surprised when it escapes the sandbox.

> There are so many keeping old php versions alive for compatibility with whatever software

If only there was a way to trivially rewrite just about any software

Fyi updated versions are now available for the Gentoo Linux distribution: https://packages.gentoo.org/packages/dev-lang/php

(I just ran an "emerge --sync" but the mirror that was used does not have yet the updates)

Ubuntu's updates have hit their package archives too:

https://ubuntu.com/security/CVE-2026-109618

FreeBSD ports tree has the updates in their git now.

Also released on Docker Hub now

Are they though?

  $ docker pull php:8.4.27
  8.4.27: Pulling from library/php
  no matching manifest for linux/arm64/v8 in the manifest list entries
  
  $ docker pull --platform linux/amd64 php:8.4.27
  8.4.27: Pulling from library/php
  no matching manifest for linux/amd64 in the manifest list entries

yep... same issue with 8.2.35-apache.

Docker hub shows the new tags but the manifests are missing https://hub.docker.com/_/php

Reply on news.ycombinator.com