PHP 8.2.35

Looks like a co-ordinated disclosure between Wiz, Calif and OpenAI:

https://www.php2shell.com/

https://www.wiz.io/blog/php2shell-php-rce

https://calif.io/php2shell/

https://openai.com/index/coordinated-disclosure-of-critical-... (not yet live)

https://thephp.foundation/blog/2026/10/21/todays-php-securit... (not yet live)

Related:

Today's PHP security release, and how we're strengthening security - https://news.ycombinator.com/item?id=50182987 - Oct 2026 (114 comments)

PHP2Shell: AI uncovers critical RCE in PHP - https://news.ycombinator.com/item?id=50180836 - Oct 2026 (146 comments)

PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) - https://news.ycombinator.com/item?id=50176077 - Oct 2026 (61 comments)

Security advisory: Critical remote code execution vulnerabilities, update now - https://news.ycombinator.com/item?id=50172041 - Oct 2026 (631 comments)

Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming - https://news.ycombinator.com/item?id=50167754 - Oct 2026 (60 comments)

Looks like there might be a second vulnerability: https://fedi.katze.sh/@elise/117479383739450605

Edit: and it's live now 1hour 43minutes after. Edit 2x: well I spoke too soon. not actually live - the 8.4.27 tag appeared, but it's still an empty shell with no amd64 image to build from. Maybe other architectures can be built from though. Ugh. Now we're at 2hours 24minutes in. I know process steps take time/can't be rushed, and I know people mean well and surely some are unappreciated for what they do. That said: this debacle is making me want to reassess my deployment pipeline choices.

how does Docker not yet have a new, official PHP image ready, given such a big heads up? https://hub.docker.com/_/php Nuts this wasn't ready to flip on at :00 (or even earlier given the PoC exploit and even the official PHP fixes were out well before). Now we are 52 minutes past due. (posting comment again, because the other thread i posted in was marked as dupe.)

This is obviously bad, but in my 20 years of hosting with PHP, I've never had to take the steps of taking down servers preemptively. It's not good, but honestly, and I think the way this was handled could leave a lot to be desired, I think this might be the "worst" we've had with PHP, and it took a while to get here.

Someone is saying there is a new vulnerability that works on the newest 8.5.12 https://x.com/_annieversary/status/2112933589943742598

Ondrej might appreciate some monetary love on a day like today.

https://www.patreon.com/cw/oerdnj

Advisories with the details are public:

https://github.com/php/php-src/security/advisories/GHSA-w8hw...

https://github.com/php/php-src/security/advisories/GHSA-6wmf...

Despite this coordination, WP-Engine (who's major business is hosting WordPress sites) is still on PHP 8.4.26 a full 2.5 hours after the patch is publicly available.

https://wpenginestatus.com/incidents/969801

Click the associated tag:

> This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Glorious. Today of all days it would genuinely give me pause for caution.

edit: yeah, really not feeling that: https://github.com/php/php-src/compare/php-8.2.34..php-8.2.3...

Hopefully just a mistake? But looks like a botched release at the least

> out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

If only we could come up with a way to manage memory automatically. Alas, one can only dream.

Just pulled the new matomo that was published on dockerhub 26 minutes ago, thinking it has the patched PHP version:

  # docker pull matomo:latest
  latest: Pulling from library/matomo
  Digest: sha256:6e63589d31ec653f78e029084d21488640fdbbd9a42c96c872098f42c8678a02
  Status: Image is up to date for matomo:latest
  docker.io/library/matomo:latest
  
  # docker run --rm matomo:latest php --version
  PHP 8.4.26 (cli) (built: Oct 21 2026 00:31:19) (NTS)
  Copyright (c) The PHP Group
  Built by https://github.com/docker-library/php
  Zend Engine v4.4.26, Copyright (c) Zend Technologies
      with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies

If LLM's are going to keep finding vulnerabilities of this magnitude, we'll be sure to face a computer worm event of unprecedented scale soon. Best be ready for the moment the lights turn off

FML. Can't get in to update our servers because of MFA and our director, who gets the codes, isn't in

Does anyone know how long it takes for the ondrej/php repo to be patched usually?

So far Ubuntu LTS isn’t picking up the new packages for me via apt update, and Laravel Forge appears completely unresponsive as a result of being flooded by people trying to update their servers.

https://ubuntu.com/security/CVE-2026-109618#status fixes have been back ported in Ubuntu LTS versions just now.

how does Docker not yet have a new, official PHP image ready, given such a big heads up? https://hub.docker.com/_/php Nuts this wasn't ready to flip on at :00 (or even earlier given the PoC exploit and even the official PHP fixes were out well before). Now we are 27 minutes past due.

Is there a curl command I can use to test if the vulnerability is fully patched on a server (not merely mitigated) without causing any harm?

Note I want it to work with the backports too, not just the latest version.

Hard to deploy if you also install extensions from PECL right now (probably slammed).

Does anyone know the ETA on the official php:* docker images? I think they only released patched 8.6 RC containers for now.

i just took down all my PHP sites for the last few hours. they’re proxied behind Cloudflare so i know there were mitigations, but infrastructure can’t be breached if it isn’t running!

Has there yet been any signs of any service actually being successfully hacked due to the vulnerability?

Still no release for Ubuntu... They are already half an hour late. Debian got the patch almost immediately...

Interview with two of the discoverers: Breaking Down PHP2Shell with Sagi Tzadik (Wiz) & Thai Duong (Calif)

https://www.youtube.com/watch?v=lfEtbrz4-zY

CISA published an advisory half an hour ago:

https://www.cisa.gov/news-events/alerts/2026/10/21/critical-...

>Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.

And there were people who thought Project Glasswing was a stunt.

Since I have to go through a bunch of php repos today at work I ended up releasing a CLI tool that automates that process by listing out the steps you need to take to stay away from the vulnerability. Here's the link incase it helps anyone https://github.com/Amsozzer1/php2shell-repo-audit

Sury released backports for older versions, as always hes incredibly reliable.

Why is the description of "RCE via OOM corruption" mentioning all these settings like memory_limit, post_max_size, max_input_nesting_level etc under "Mitigation" but not blocking multipart requests? Isn't that a solution?

The description of the vurnurability "Several multipart parsing problems" makes it sound like it is?

Code example for the exploits https://github.com/david-alvarez-rosa/php-rce

Does anybody know when Amazon Linux 2023 will get this release?

PPA packages on LaunchPad being built here: https://launchpad.net/~ondrej/+archive/ubuntu/php/+builds?bu...

Great that its out but if you depend on pecl for additional extensions and need to rebuild docker container it will probably fail because pecl is having issues for last few hours[1].

[1] https://status.php.net/

It says pecl.php.net recovered but downloading source for extensions ends up with 504 most of the time.

Versions: 8.2.35 8.3.36 8.4.27 8.5.12

Now are available in the php-src github

Looks like the docker images are struggling in the Jenkins queue: https://doi-janky.infosiftr.net/

My hosting provider just informed me that they took down my website over this to "protect" me. It's a static website that does not use any php. But it's a generic LAMP hosting provider so they just took down all their hosted websites. I had it on my to do list to migrate that to cloudflare anyway. So, I guess I'll be doing that soonish now.

If open source has these vulnerabilities, imagine proprietary ones.

The best time to code away from PHP was 20 years ago. The next best time is now.

Apparently about 40% of PHP apps are still on PHP 7 and 5...

Trying to install this update but it appears that Launchpad doesn’t have the bandwidth for half the world to all update at the same time.

I was under the impression that this sort of bug is fairly common in both php and common php frameworks?

I thought the real lesson was "assume your web server is compromised if you use php, and try to make sure php doesn't touch anything too critical"

apt-get update + apt-get upgrade fixes it on Debian, but not on Ubuntu for now

How does this not have a CVSS of 10?

Seems like they finally decided to release it after so many people had access. What happened to security as a priority.

debian trixie just rolled updates.

I've created patched Dockerfiles for EOL PHP versions. The patch is obtained from official source trees.

I've also published the built images from them to GitHub Registry, but of course it's best to inspect any public repo/docker image before using them blindly.

https://github.com/a-nych/php-eol-backports

While the patches are being merged for the official docker images, perfect time for a github outage! https://downdetector.com/status/github/

Gentoo has it updated.