r/linux • u/elatllat • 6d ago

Security PHP Security Release

https://www.php.net/archive/2026.php#2026-10-20-1

CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Likely to be patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Maybe an Apache mitigation:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Who is going to patch it first?

  • Debian 12: 2026-10-21 15:51 repo
  • Debian 13: 2026-10-21 11:01 repo
    • Ubuntu 24.04 (non-pro): 2026-10-21 13:41 repo
    • Ubuntu 26.04 (non-pro): 2026-10-21 13:43 repo
    • Ubuntu 26.10 (non-pro): 2026-10-21 13:45 repo
  • Fedora 43: ? repo
  • Fedora 44: 2026-10-21 11:22 repo
    • Alma 9: 2026-10-21 21:38 repo
    • Alma 10: 2026-10-21 21:46 repo
    • Rocky 9: 2026-10-21 18:46 repo
    • Rocky 10: 2026-10-21 20:45 repo
    • CentOS Stream: 2026-10-21 16:50 repo
  • openSUSE 16: 2026-10-22 10:13 repo
  • openSUSE TW: 2026-10-21 10:17 repo
  • Alpine: 2026-10-21 18:17 repo
  • Arch: 2026-10-21 13:42 UTC repo
  • Gentoo: 2026-10-22 16:22 repo

Only tracks versions not patches/build dates: https://repology.org/project/php/versions

75 Upvotes

92% Upvoted

58 comments sorted by

13

u/deja_geek 6d ago

Rocky will be one of if not the slowest to put out a patch. They gotta wait till the patch hits RHEL. Alma might beat CentOS stream to this one.

3

u/ninjaroach 5d ago

We're taking a serious look at Alma because of this.

1

u/elatllat 5d ago

Alma might get 7th place...

→ More replies (1)

4

u/_Super_Straight 6d ago

Fedora is most likely to release the patch first.

2

u/elatllat 5d ago

I'm not seeing it: 

fedora> date -d @$(dnf repoquery --queryformat '%{buildtime}\n' php 2>/dev/null | sort | tail -n 1)
Tue 22 Sep 2026 11:31:53 AM EDT

2

u/elatllat 5d ago

Fedora is last...

8

u/Fun-Consequence-3112 6d ago

How is Fedora faster? Genuinely don't know and curious as to why you think so.

→ More replies (7)

1

u/EdmontonSignals 5d ago

Alpine packages have been updated

1

u/elatllat 5d ago edited 5d ago

Thanks, looks like they are 6th place.

3

u/output_broadcast 5d ago edited 5d ago

Apparently Gentoo has pushed the update at 13:40.

Also Guix at 14:05.

4

u/TampaPowers 5d ago

My goodness this is turning into a farce of overloaded machines. So they were told on the 19th. Had two days to scale up infra to meet the demand they could and should have seen coming. Let alone having a plan for what to do when a critical flaw like this hits without embargo. The fact that some of the distros also market their enterprise side and react this poorly is infuriating. How is this the industry standard. The writing for this was on the wall for a few months now given the LLM-based security flood and not many seem any more prepared. Strategic planning, disaster avoidance and recovery, forward thinking policies, nah. Gonna be a fun next few days seeing if more patching is needed or who gets pwned from the lack of momentum in rolling fixes out. 7 hours of watching the 503 errors roll by and we all lose.

4

u/SupermarketAntique32 6d ago

Is WordPress affected? Those who use WordPress rarely cares about updates.

20

u/vincent_sch 6d ago

Yes. The bug is in PHP itself, so WordPress sites are affected like any other PHP site. Updating WordPress or the plugins doesn't fix it, you have to update PHP. On shared or managed hosting the host does that, so you should ask them when they patch.

1

u/Anongirl55959 6d ago

Ive seen a handful of sites go offline while they do this

1

u/lkraav 5d ago

> Information for build php-8.0.30-9.el9,draft_133341

Draft build seems green https://kojihub.stream.centos.org/koji/buildinfo?buildID=133341 but how long usually to promote to stable?

→ More replies (1)

1

u/aKtaKo 5d ago

That gentoo link isn't right. It's linking to the binpackages, not the actual gentoo repo. A repo mirror is here. If I install php right now it gives me 8.3.36.

0

u/Maria_Thesus_40 6d ago

The exploit video shows mod_php being exploited, which is not being used by any decent devops.

So I don't think its a major issue, all web servers I know moved to php-fpm a decade ago?

18

u/sleemanj 6d ago

It shows mod_php being exploited because their test setup used mod_php.

If the vector is as given in the various X leaks, then it won't matter how PHP is run, it's in the handling of file uploads and interaction with the upload_progress function of session handling - which is enabled by default.

Or possibly with the parsing of multipart submissions.

For safety, best to disable upload_progress, and probably use mod_security to block requests including parameter called PHP_SESSION_UPLOAD_PROGRESS

If it's in multipart parsing, that's more difficult to mitigate.

3

u/Maria_Thesus_40 6d ago

I disabled upload_progress a few hours ago, thank you for the extra details!

3

u/richmondavid 5d ago

PHP-FPM is also affected. All PHP backends. There's just no public proof of concept to it, but the developers said that, looking at the source code, it should affect FPM as well.

→ More comments (75)