r/hacking • u/tankton • 11h ago

Vulnerability php patch is available now

https://www.php.net/archive/2026.php#2026-10-21-5
120 Upvotes

96% Upvoted

12 comments sorted by

14

u/Fujinn981 10h ago

Love having to patch stuff in the morning

18

u/Highfivesghost 10h ago

Someone on another post on Reddit say “AI slop security”. Classic Reddit moment

3

u/macgamecast 10h ago

Do I have to restart my whole server? Or is updating and restarting php service enough. My site info/health does show the new version. 

2

u/AdeTheux newbie 10h ago

Same here (but I'm a big noob). I rebooted because I don't care, it's Pi to learn stuff. But only php shows the correct .27 version, all the modules like php8.4-gmp are still .26 after the reboot.

1

u/Lefty4444 8h ago

Check all workers

1

u/BuffPotter 53m ago

Restart phpfpm

4

u/lolman5555 8h ago

How do you actually use the exploit on sites

2

u/Itz_Raj69_ 8h ago

Search for the PoC

1

u/lolman5555 7h ago

This? https://jackalsyn.com/posts/php-up-2026.html

1

u/Itz_Raj69_ 7h ago

Yep. That doesn't have the a PoC for the RCE part of the vuln though

-2

u/lolman5555 7h ago

Can you DM me which one please?

1

u/Itz_Raj69_ 7h ago

I haven't looked for one/found one either. You could probably make an abliterated AI model write one