PHP patched two unauthenticated RCE bugs after the CVE IDs leaked two days early
A request that hits memory_limit at the wrong moment can corrupt memory. A fatal error can leave a use-after-free for the next request on the same worker. Both lead to remote code execution.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on 21 October, a day ahead of plan, after the CVE IDs leaked. Both bugs score CVSS 9.2 and need no login, and a proof-of-concept video went up by mistake.
In the thread, an admin racing across several servers said a three-line nginx rule blocking multipart uploads had been quietly protecting a machine he could not shut down.
Two bugs, one score, and a leaked 10.0
The PHP Foundation's announcement covers two critical flaws that let an unauthenticated attacker run code on a server. CVE-2026-109618 is memory corruption when a request hits memory_limit at the wrong moment. CVE-2026-109619 is stale global state: a fatal error can leave a use-after-free that a later request on the same worker can hit. Both score CVSS 9.2; a leaked score of 10.0 was wrong.
Disclosure went badly. The CVE IDs leaked two days early, which pulled the release from 22 October to 21 October at 14:00 UTC. A proof-of-concept video from Calif was published by mistake, and Chainguard shipped fixed images more than six hours before the coordinated release.
What the foundation says it will change
The foundation created an Ecosystem Security Team in May 2026 and has added Volker Dusch as AI Security Engineer in Residence, Alexandre Daubois in July and Daniel Scherzer in September. Security decisions will move to majority votes, and leadership will be able to steer stalled fixes. Since 1 July the team has published 15 CVEs and worked through more than 100 invalid, duplicate or non-reproducible reports. It is asking companies, hosts, distributions and governments for sponsorship.
The thread: a day of mitigations
"a three line nginx mitigation (blocking multipart uploads) I wrote in the wee small hours GMT has been quietly protecting a vulnerable machine I could not shut down" — an admin who spent the day patching several servers
The day also prompted a question: how do you avoid missing the next CVE? One answer was bleak.
"I don't think there's any robust method." — a developer who follows HN, security lists and code scanners
And for those who had already left:
"Is it just me, or is it the truly brave that decide to deploy and protect PHP instances?" — a developer who moved off PHP and WordPress last year
The foundation demonstrated full RCE on Apache with mod_php, and confirmed the first bug on PHP-FPM through application code paths. Check which SAPI you run and which application code reaches it before deciding how fast to patch; the multipart-upload block above is a stopgap, not a fix.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
DuckDB 2.0 adds a server mode and async I/O, and files that 1.x cannot open
DuckDB 2.0.0 LTS, "Cinnamon Teal", is the project's biggest feature release, built from close to 20,000 commits since 1.5. A database file it writes will not open in any earlier version.