[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAFfBHfYhgRfN3A1JsfyUN-hPokfZnW_fHWTX_ypCZspZuHgFVw@mail.gmail.com>
Date: Wed, 21 Oct 2026 12:29:01 -0500
From: Aaron Rainbolt <arraybolt3@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
On Wed, Oct 21, 2026 at 10:24 AM Aaron Rainbolt <arraybolt3@...il.com> wrote:
...snip...
> While not yet fully confirmed, the Fediverse is reporting that the fix
> to at least PHP 8.5.12 may be incomplete:
> https://fedi.katze.sh/@elise/117479383739450605
According to a conversation in #security:ubuntu.com Matrix, Canonical
asked php.org if the issue mentioned in this Mastodon thread was a
real vulnerability or not, and was told that it's "unrelated and not a
real issue". If someone from the PHP security team could reconfirm
this here, that would be greatly appreciated.
--
Aaron
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
