| tl;dr: PHP 8.2.35 patches two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that enable unauthenticated remote code execution, with no mitigations available other than updating. All PHP 8.2 users should upgrade immediately, and note that PHP 8.2 reaches end of life on December 31, 2026. |
| HN Discussion:- ↑Points out this is a coordinated disclosure involving Wiz, Calif, and OpenAI with supporting links
- ~Reflects that despite severity, PHP has had a strong security track record over 20 years
- ~Highlights additional vulnerabilities beyond the ones mentioned, including one affecting newer versions
- ↓Criticizes the botched release process, including delayed Docker images and suspicious tag commits
- ↑Notes that major hosts like WP-Engine are slow to patch despite coordinated disclosure
|