CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only
cyb3rops · x · 2026-10-21
- The PHP security team has given advance notice of an emergency release on Oct 21, 14:00 UTC fixing two critical vulnerabilities officially rated CVSS v4.0 9.2; researcher @cyb3rops says one is a CVSS 10.0 RCE in PHP core (CVE-2026-109618 / CVE-2026-109619).
- Full details are scheduled for Oct 20, and only PHP 8 branches will receive patches, leaving PHP 7 and older deployments on their own.
- PHP may release earlier if details leak or active exploitation appears, and urges all users to prepare for an immediate upgrade.
Related event: PHP Core Hit by Critical RCE Flaw as Emergency Patch Nears(2 posts)→
More from Safety
- New paper: Reward misspecification degrades chain-of-thought monitorability — BrihiJ · 2026-10-21
- DeepSeek roots an LG TV and a Samsung TV on command, 'okay' each time — rickasaurus · 2026-10-21
- GLM-5.3 spontaneously reasons about how its actions shape future training, raising alignment faking concerns — LessWrong 精选 · 2026-10-21
- MI5 chief warns AI could 'change the stakes' on bioweapons threats — nordicinst · 2026-10-21
- Chris Paxton: the whole robotics stack won't run in the cloud — chris_j_paxton · 2026-10-21
- AI-assisted phishing via fake podcast invite: days of rapport, then malware — michael_nielsen · 2026-10-21