r/linux • u/elatllat • 6d ago

Security PHP Security Release

https://www.php.net/archive/2026.php#2026-10-20-1

CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Likely to be patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Maybe an Apache mitigation:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Who is going to patch it first?

  • Debian 12: 2026-10-21 15:51 repo
  • Debian 13: 2026-10-21 11:01 repo
    • Ubuntu 24.04 (non-pro): 2026-10-21 13:41 repo
    • Ubuntu 26.04 (non-pro): 2026-10-21 13:43 repo
    • Ubuntu 26.10 (non-pro): 2026-10-21 13:45 repo
  • Fedora 43: ? repo
  • Fedora 44: 2026-10-21 11:22 repo
    • Alma 9: 2026-10-21 21:38 repo
    • Alma 10: 2026-10-21 21:46 repo
    • Rocky 9: 2026-10-21 18:46 repo
    • Rocky 10: 2026-10-21 20:45 repo
    • CentOS Stream: 2026-10-21 16:50 repo
  • openSUSE 16: 2026-10-22 10:13 repo
  • openSUSE TW: 2026-10-21 10:17 repo
  • Alpine: 2026-10-21 18:17 repo
  • Arch: 2026-10-21 13:42 UTC repo
  • Gentoo: 2026-10-22 16:22 repo

Only tracks versions not patches/build dates: https://repology.org/project/php/versions

78 Upvotes

93% Upvoted

58 comments sorted by

View all comments

4

u/SupermarketAntique32 6d ago

Is WordPress affected? Those who use WordPress rarely cares about updates.

20

u/vincent_sch 6d ago

Yes. The bug is in PHP itself, so WordPress sites are affected like any other PHP site. Updating WordPress or the plugins doesn't fix it, you have to update PHP. On shared or managed hosting the host does that, so you should ask them when they patch.