Two critical PHP vulnerabilities, rated 9.2. Their CVE numbers leaked a day before the fix, and some governments took their own sites offline rather than run unpatched. Two weeks of PHP Internals in one episode.

This Week in PHP Internals, October 22, 2026: two weeks, 18 stories, about 23 minutes.
https://youtu.be/4ze2Re_-gMQ

#PHP #PHPInternals #PHP86

To increase PHP representation in open source research, we encourage you to take the 2027 State of Open Source Survey. Perforce, in collaboration with the Open Source Initiative and the Eclipse Foundation, have released the survey and you can take it here: https://www.research.net/r/ZXLCRSF #php #research

If all the governments shutting down their servers for a PHP vulnerability, all the hosting companies and enterprises terrified by the vuln, would give $100k, heck only $50k a year to the PHP Foundation, things could look very differently. Go make your employer sponsor *today* https://thephp.foundation/sponsor/ #php #phpc @thephpf

🎬 Roll tape! Our newest podcast is live.
The PHP Podcast 2026.10.22
https://www.phparch.com/podcast/the-php-podcast-2026-10-22/

Time is running out to get your talks submitted for PHP Tek 2027. Don't miss out on all the perks of being a speaker.

https://cfp.phptek.io

Did all my #php patching. If you haven't yet go do it!

RE: https://mastodon.rfc1925.org/@ondrej/117477496792851278

Toss a coin to your PHP package builder. https://github.com/sponsors/oerdnj

Well done #php core team for handling today so well, and for all your efforts! I know it can't have been easy. Hope you all rest well tonight!

🚨 FrankenPHP 1.13.2 is officially live!

This is a security release patching a critical PHP vulnerability (PHP2Shell) alongside 4 vulnerabilities in FrankenPHP itself.

Upgrading immediately is strongly recommended:

🐳 Docker: Refreshed! 1.13.1 (PHP 8.5.12) and all 1.13.2 images (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12) are ready.
⚙️ Binaries: Static binaries published with patched PHP 8.5.12.

A big thanks to Alex Dubois, Marc Henderkes, the PHP Foundation and everyone involved!

It's been a heck of a day, but thanks for all the chatter and useful input @phpc! #php

HUUUUUUUUGE kudos to the PHP core team! Let's get to patching!

If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.

#php

Since Remi's repo is not getting updated today I’m going to build from source. Here is my plan:

https://blog.thms.uk/2026/10/rebuild-remi-php-packages-almalinux/?utm_source=mastodon

I have done steps 1 & 2. Let's hope steps 3-5 will also work in a few minutes.

Maybe it'll help someone. No guarantees though, as I haven't done it yet.

#php #AlmaLinux

And it's up! https://www.php.net/

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

I don't think the Ubuntu repos are updated yet, but they shouldn't be too far away.

This is the #PHP exploit, in the Wall Street Journal:

AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea

https://www.php.net/archive/2026.php#2026-10-21-5

#php #php2shell

Hugs and headpats to all the #PHP release managers today!

Upgrade your PHP at 14:00 UTC today!

https://www.php.net/archive/2026.php#2026-10-20-1

RE: https://mastodon.rfc1925.org/@ondrej/117477496792851278

I know that many people rely on the DEB packages to install PHP, but real heroes are the upstream PHP engineers that prepared the fixes and coordinated the disclosure. If you rely on PHP to do a business and make money, you should also think about supporting @thephpf !

RE: https://infosec.exchange/@watchTowr/117474644870827640

Small update: we've now pushed network-level mitigation capabilities to watchTowr Platform clients (via Active Defense), ahead of PHP providing patches.

https://watchTowr.com for more information.

The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2.

All PHP users are encouraged to prepare so they can upgrade immediately tomorrow. Should details of the vulnerabilities become public, or should evidence of active exploitation appear we will release sooner.

Full details, affected versions, and the fixed versions will be published with the release.

#php