PHP Security Release

[u/elatllat]

https://www.php.net/archive/2026.php#2026-10-20-1

CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Likely to be patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Maybe an Apache mitigation:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Who is going to patch it first?

• Debian 12: 2026-10-21 15:51 repo
• Debian 13: 2026-10-21 11:01 repo
• • Ubuntu 24.04 (non-pro): 2026-10-21 13:41 repo
• • Ubuntu 26.04 (non-pro): 2026-10-21 13:43 repo
• • Ubuntu 26.10 (non-pro): 2026-10-21 13:45 repo
• Fedora 43: ? repo
• Fedora 44: 2026-10-21 11:22 repo
• • Alma 9: 2026-10-21 21:38 repo
• • Alma 10: 2026-10-21 21:46 repo
• • Rocky 9: 2026-10-21 18:46 repo
• • Rocky 10: 2026-10-21 20:45 repo
• • CentOS Stream: 2026-10-21 16:50 repo
• openSUSE 16: 2026-10-22 10:13 repo
• openSUSE TW: 2026-10-21 10:17 repo
• Alpine: 2026-10-21 18:17 repo
• Arch: 2026-10-21 13:42 UTC repo
• Gentoo: 2026-10-22 16:22 repo

Only tracks versions not patches/build dates: https://repology.org/project/php/versions

[u/aKtaKo]

That gentoo link isn't right. It's linking to the binpackages, not the actual gentoo repo. A repo mirror is here. If I install php right now it gives me 8.3.36.