[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <atnQRDzU7H2h5_w2@mars-attacks.org>
Date: Thu, 22 Oct 2026 10:58:44 +0200
From: Nicolas Vigier <boklm@...s-attacks.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
On Wed, 21 Oct 2026, Aaron Rainbolt wrote:
> On Wed, Oct 21, 2026 at 10:24 AM Aaron Rainbolt <arraybolt3@...il.com> wrote:
>
> ...snip...
>
> > While not yet fully confirmed, the Fediverse is reporting that the fix
> > to at least PHP 8.5.12 may be incomplete:
> > https://fedi.katze.sh/@elise/117479383739450605
>
> According to a conversation in #security:ubuntu.com Matrix, Canonical
> asked php.org if the issue mentioned in this Mastodon thread was a
> real vulnerability or not, and was told that it's "unrelated and not a
> real issue". If someone from the PHP security team could reconfirm
> this here, that would be greatly appreciated.
https://codeberg.org/oerdnj/deb.sury.org/issues/145#issuecomment-26090654
"The PHP team is aware of that report and there are no new plans as of
now."
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
