PHP pre-announced critical RCE flaws before patches, leaving a global exposure window
NathanpmYoung · x · 2026-11-02
PHP officially announced critical remote code execution vulnerabilities before patches were available, prompting security researcher @sherlockcomms to warn of a window where attackers know the flaws exist but defenders have no official fix. The advisories only confirmed the flaws' existence, severity and patch date, withholding details until release. The same archive covers a Brotli out-of-bounds write (CVE-2026-111497) affecting Windows builds via cURL auto-decompression, and a session upload progress RCE vector (mitigation: set session.uploadprogress.enabled=0). Notably, the screenshot shows a Community Note marked "Written by AI" rated helpful.
More from Safety
- Alabama passes age-verification law 138-0 for all app downloads; Big Tech lobby sues — amplifiedamp · 2026-11-02
- Purser: an MCP server that lets agents pay with smart-contract limits a jailbreak can't bypass — Plane-Preference6245 · 2026-11-02
- "Copyright is for courts to decide, not for the tool to tell me what I can make" — adamamcbride · 2026-11-02
- US data companies quietly sell to Chinese AI labs — a shadow market with no oversight — karinanguyen · 2026-11-02
- Grok Confirms Chrome macOS Vulnerability Patched Since 155.0.8059.39 — emax · 2026-11-02
- Scale AI CEO Warns: Halloween 'Muse' Asking for Your Number Is a Phishing Attack — alexandr_wang · 2026-11-02