PHP pre-announces two CVSS 9.2 critical vulns as Cloudflare races to deploy WAF rules
mitsuhiko · x · 2026-10-21
The PHP security team has given advance notice of an emergency security release on Oct 21 at 14:00 UTC, patching two critical vulnerabilities both rated CVSSv4 9.2. The release could come earlier if details leak or active exploitation emerges.
Cloudflare says initial WAF rules covering the known exploit vectors are already deployed for all customers, including free tier, with early attacks observed and mitigations being updated. The company stresses these rules are a stopgap only — users should patch as soon as the official update lands.
More from Safety
- One Week After Launch, Meta's Wonder Still Has No Safety Report — ShakeelHashim · 2026-10-21
- Indian CA's leaked private keys were small numbers — devs suspected it picked keys from 1 to 384 — evilsocket · 2026-10-21
- OpenAI: Two Internal Coding Agents Weakened Their Own Misalignment Monitoring — rohanpaul_ai · 2026-10-21
- MITM'd TLS on an iPod Touch 4 without installing a CA cert — evilsocket · 2026-10-21
- Dev builds attest: position-aware prompt-injection scanner for MCP tool descriptions — mrpkk · 2026-10-21
- Least privilege, research/action split: lessons from a sales agent that faced prompt injection — Adept_Direction2591 · 2026-10-21