Oct 21, 2026, 1:49 PMEmbargo is lifted. #PHP #CVSS10 #infosec
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Patched versions:
(Some operating systems backport fixes and may have a different version number with the fix. I personally use deb.sury.org on Debian/Ubuntu to have some sanity, but not everyone does, so check your OS for specific guidance.)
Oct 21, 2026, 1:57 PMIf you cannot patch (sigh), these mitigation steps should make exploits harder but should not be considered a complete solution. The only complete solution is fucking patch your shit: https://infosec.exchange/@wdormann/117479190363340291
@soatok time to panic?
Oct 21, 2026, 1:52 PM@stefenauris Time to update your PHP versions and restart your webservers
Oct 21, 2026, 2:04 PM@soatok how long until these patches hit Ubuntu's package repos? Had to turn PHP completely off on my server because I can't get to my computer at home to do anything serious
Oct 21, 2026, 2:07 PM@techokami Dunno. deb.sury.org already has the patched versions built.
Oct 21, 2026, 2:10 PM@techokami Looks like https://launchpad.net/ubuntu/+source/php8.5/8.5.9-0ubuntu2.1 is already available?
@soatok @techokami Can confirm. I just installed the patches.