#coordinated-disclosure

MVMaker Views #ai-security-research #coordinated-disclosure #disclosure #Hacker-News #patch #php #remote-code-execution #vulnerability #web-servers

PHP patches two critical remote code execution flaws after a leak forces an early release

If you run PHP, update. The Foundation post is a frank account of how a 2024 lead stalled and how the disclosure unraveled.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution: CVE-2026-109618 (out-of-memory handling leaves request data half-initialized) and CVE-2026-109619 (state from a freed request is reused by a later one). The PHP project says every installation serving web requests is at risk, mod_php most of all, and urges an immediate update; it also published minimal backports for PHP 7.4 to 8.1.

The PHP Foundation says the first signs of the memory bug surfaced during a 2024 audit, but work on a fix stalled, which it calls a structural failure. Reports from Calif, OpenAI and Wiz in August made the impact clear. After the CVE IDs leaked on October 20, the release was moved up a day; security firm Calif mistakenly published a demo video, and the Foundation says Chainguard broke the embargo by publishing fixed images hours early.

Three Hacker News threads (the top one 1,549 points) argued over embargoes versus releasing fixes at once, Chainguard's move, and admins racing to patch or shut servers down.

Read it at the source

PHP.netPHP: News Archive - 2026 Independent ↗ The PHP FoundationToday's PHP Security Release, and How We're Strengthening PHP Security Independent ↗ GitHub (php-src)Release PHP 8.2.35 · php/php-src Independent ↗ Hacker NewsDiscussion: Security advisory: Critical remote code execution vulnerabilities, update now Independent ↗ Hacker NewsDiscussion: PHP 8.2.35 Independent ↗ Hacker NewsDiscussion: Today's PHP security release, and how we're strengthening security Independent ↗ AWS Security BlogAmazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot Independent ↗ WizPHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Independent ↗

Cascadic Analysis 1

UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

Amazon says it saw an exploit attempt on its honeypots on October 17, four days before disclosure, and proof-of-concept exploits within hours of release, adding that AI-assisted analysis makes it cheaper to turn a patch or advisory into a working exploit. The PHP Foundation describes the other side: AI-assisted research means far more reports, with 15 CVEs since July 1 and more than 100 reports that turned out to be invalid, all handled by a small team.

Rabbit Holes 2

Coordinated vulnerability disclosure

After exploring Today's PHP Security Release, and How We're Strengthening PHP Security, to see why the embargo mattered so much, read about Coordinated vulnerability disclosure.

The disclosure model in which a flaw is made public only after the responsible parties have had time to fix it, as opposed to full disclosure.

Wikipedia · Wade · 5 min

0
Dangling pointer

After exploring PHP: News Archive - 2026, for the class of bug behind the second flaw, try Dangling pointer.

Pointers that no longer point to a valid object, a kind of memory safety violation behind use-after-free bugs.

Wikipedia · Swim · 30 min

0