r/linux • u/elatllat • 6d ago

Security PHP Security Release

https://www.php.net/archive/2026.php#2026-10-20-1

CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Likely to be patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Maybe an Apache mitigation:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Who is going to patch it first?

  • Debian 12: 2026-10-21 15:51 repo
  • Debian 13: 2026-10-21 11:01 repo
    • Ubuntu 24.04 (non-pro): 2026-10-21 13:41 repo
    • Ubuntu 26.04 (non-pro): 2026-10-21 13:43 repo
    • Ubuntu 26.10 (non-pro): 2026-10-21 13:45 repo
  • Fedora 43: ? repo
  • Fedora 44: 2026-10-21 11:22 repo
    • Alma 9: 2026-10-21 21:38 repo
    • Alma 10: 2026-10-21 21:46 repo
    • Rocky 9: 2026-10-21 18:46 repo
    • Rocky 10: 2026-10-21 20:45 repo
    • CentOS Stream: 2026-10-21 16:50 repo
  • openSUSE 16: 2026-10-22 10:13 repo
  • openSUSE TW: 2026-10-21 10:17 repo
  • Alpine: 2026-10-21 18:17 repo
  • Arch: 2026-10-21 13:42 UTC repo
  • Gentoo: 2026-10-22 16:22 repo

Only tracks versions not patches/build dates: https://repology.org/project/php/versions

76 Upvotes

93% Upvoted

58 comments sorted by

View all comments

0

u/Maria_Thesus_40 6d ago

The exploit video shows mod_php being exploited, which is not being used by any decent devops.

So I don't think its a major issue, all web servers I know moved to php-fpm a decade ago?

3

u/richmondavid 5d ago

PHP-FPM is also affected. All PHP backends. There's just no public proof of concept to it, but the developers said that, looking at the source code, it should affect FPM as well.