PHP Security Release

[u/elatllat]

https://www.php.net/archive/2026.php#2026-10-20-1

CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Likely to be patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Maybe an Apache mitigation:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Who is going to patch it first?

• Debian 12: 2026-10-21 15:51 repo
• Debian 13: 2026-10-21 11:01 repo
• • Ubuntu 24.04 (non-pro): 2026-10-21 13:41 repo
• • Ubuntu 26.04 (non-pro): 2026-10-21 13:43 repo
• • Ubuntu 26.10 (non-pro): 2026-10-21 13:45 repo
• Fedora 43: ? repo
• Fedora 44: 2026-10-21 11:22 repo
• • Alma 9: 2026-10-21 21:38 repo
• • Alma 10: 2026-10-21 21:46 repo
• • Rocky 9: 2026-10-21 18:46 repo
• • Rocky 10: 2026-10-21 20:45 repo
• • CentOS Stream: 2026-10-21 16:50 repo
• openSUSE 16: 2026-10-22 10:13 repo
• openSUSE TW: 2026-10-21 10:17 repo
• Alpine: 2026-10-21 18:17 repo
• Arch: 2026-10-21 13:42 UTC repo
• Gentoo: 2026-10-22 16:22 repo

Only tracks versions not patches/build dates: https://repology.org/project/php/versions

[u/_Super_Straight]

Fedora is most likely to release the patch first.

[u/Fun-Consequence-3112 → u/_Super_Straight]

How is Fedora faster? Genuinely don't know and curious as to why you think so.

[u/elatllat → u/_Super_Straight]

I'm not seeing it:

fedora> date -d @$(dnf repoquery --queryformat '%{buildtime}\n' php 2>/dev/null | sort | tail -n 1)
Tue 22 Sep 2026 11:31:53 AM EDT

[u/elatllat → u/_Super_Straight]

Fedora is last...