PHP ships emergency fixes for two unauthenticated RCE bugs after embargo break
kingslyj · x · 2026-10-22
- PHP released emergency updates (8.5.12/8.4.27/8.3.36/8.2.35) fixing two related critical RCE vulnerabilities; an unauthenticated attacker could execute code on servers under the right conditions. Update now.
- CVE-2026-109618: a request hitting memorylimit at exactly the wrong moment leaves partially initialized internal state treated as valid, corrupting memory; full RCE demonstrated on Apache + modphp with default settings, also confirmed on PHP-FPM.
- CVE-2026-109619: a fatal error at the wrong point leaves global state pointing at a previous request's memory, causing use-after-free in the same worker; RCE shown against a real-world target.
- Images reveal the coordinated disclosure broke down: Chainguard published patched images 6+ hours before the embargo lift, and security firm Calif accidentally published a PoC video, accelerating exploit circulation.
More from coding & agent
- How DNS encodes domain names: length-prefixed labels explained byte by byte — cneuralnetwork · 2026-10-22
- Dev builds a tiny DNS resolver in C to show how simple DNS is at the packet level — cneuralnetwork · 2026-10-22
- DNS pointer compression: how responses avoid repeating domain names — cneuralnetwork · 2026-10-22
- Stanford's Librarian Agents: RL-curated workspaces boost long-context QA by 30+ points — khademinori · 2026-10-22
- Tinker ships StableReinforce to keep off-policy RL runs from suddenly collapsing — simonguozirui · 2026-10-22
- I built an AI software factory that turns GitHub issues into PRs on autopilot — Pavan_Belagatti · 2026-10-22