PHP Security Release

[u/elatllat]

https://www.php.net/archive/2026.php#2026-10-20-1

CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Likely to be patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.

Maybe an Apache mitigation:

<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

Who is going to patch it first?

• Debian: 2026-10-21 15:51 repo
• • Ubuntu (non-pro): 2026-10-21 13:41 repo
• Fedora: ? repo
• • Alma: ? repo
• • Rocky: ? repo
• • CentOS Stream: 2026-10-21 16:50 repo
• openSUSE: 2026-10-21 10:17 repo
• Alpine: 2026-10-21 18:17 repo
• Arch: 2026-10-21 13:42 UTC repo
• Gentoo: ? repo

Only tracks versions not patches/build dates: https://repology.org/project/php/versions

[u/deja_geek]

Rocky will be one of if not the slowest to put out a patch. They gotta wait till the patch hits RHEL. Alma might beat CentOS stream to this one.

[u/ninjaroach → u/deja_geek]

We're taking a serious look at Alma because of this.

[u/elatllat → u/ninjaroach]

Alma might get 7th place...

[u/boxheadmoose → u/deja_geek]

aahhh nnooooo :(

[u/TampaPowers]

My goodness this is turning into a farce of overloaded machines. So they were told on the 19th. Had two days to scale up infra to meet the demand they could and should have seen coming. Let alone having a plan for what to do when a critical flaw like this hits without embargo. The fact that some of the distros also market their enterprise side and react this poorly is infuriating. How is this the industry standard. The writing for this was on the wall for a few months now given the LLM-based security flood and not many seem any more prepared. Strategic planning, disaster avoidance and recovery, forward thinking policies, nah. Gonna be a fun next few days seeing if more patching is needed or who gets pwned from the lack of momentum in rolling fixes out. 7 hours of watching the 503 errors roll by and we all lose.

[u/_Super_Straight]

Fedora is most likely to release the patch first.

[u/Fun-Consequence-3112 → u/_Super_Straight]

How is Fedora faster? Genuinely don't know and curious as to why you think so.

[u/_Super_Straight → u/Fun-Consequence-3112]

Fedora and Arch are generally neck to neck when it comes to patch release. But I'm certain Debian won't be the first lol.

[u/brontide → u/_Super_Straight]

Ubuntu patches are out*. Likely because they don't have to backport because 24.04 is on php 8.3 vs php 8.0 for RHEL9.

https://ubuntu.com/security/notices/USN-8948-1

\* they list packages in their advisory but I'm not seeing them in the mirrors yet

[u/emptythevoid → u/brontide]

They literally just showed up in my 22.04 server a minute ago

[u/elatllat → u/_Super_Straight]

Oddly Arch is behind Ubuntu

yay -Si extra/php | grep Build Build Date : Wed 23 Sep 2026 01:41:29 PM

[u/InternetAnon94 → u/Fun-Consequence-3112]

redhat has so most customers

[u/richmondavid → u/Fun-Consequence-3112]

Because RHEL is stable and Fedora is testing so there's no risk to push new stuff and see if it breaks in the wild.

[u/elatllat → u/_Super_Straight]

I'm not seeing it:

fedora> date -d @$(dnf repoquery --queryformat '%{buildtime}\n' php 2>/dev/null | sort | tail -n 1) Tue 22 Sep 2026 11:31:53 AM EDT

[u/elatllat → u/_Super_Straight]

Fedora is last...

[u/LcuBeatsWorking]

Debian packages just got updated. (Exactly at 14:00 UTC)

https://lists.debian.org/debian-security-announce/2026/msg00489.html

[u/The_Brovo → u/[deleted]]

12 bookworm was very fast, I got it updated this morning about 45 min ago

[u/hanspeterhipster → u/The_Brovo]

Bookworm is still on 8.2.34.

[u/emptythevoid → u/hanspeterhipster]

This is still the case for Bookworm, as of 10:50am EST, at least when hosted on Amazon lightsail

[u/richmondavid → u/emptythevoid]

Yes, everywhere. You can track the official package here:

https://tracker.debian.org/pkg/php8.2

[u/elatllat → u/richmondavid]

Not

everywhere

as there is still no arm64 build of 8.2.35

https://security.debian.org/debian-security/pool/updates/main/p/php8.2/?C=M;O=D

[u/lascar33 → u/The_Brovo]

How did you get the update ?
I don't get it when I update package list

[u/SparOfAndii → u/lascar33]

Try now. I just got it on Bookworm

[u/elatllat → u/LcuBeatsWorking]

https://security.debian.org/debian-security/pool/updates/main/p/php8.2/?C=M;O=D

Still no 8.2.35 for arm64...

[u/lascar33 → u/elatllat]

8.2.35 just been update @ 16:09 UTC on debian 12 ARM

[u/elatllat → u/lascar33]

Thanks for letting me know; I updated the post, looking into other distributions now...

[u/SupermarketAntique32]

Is WordPress affected? Those who use WordPress rarely cares about updates.

[u/vincent_sch → u/SupermarketAntique32]

Yes. The bug is in PHP itself, so WordPress sites are affected like any other PHP site. Updating WordPress or the plugins doesn't fix it, you have to update PHP. On shared or managed hosting the host does that, so you should ask them when they patch.

[u/Maria_Thesus_40]

The exploit video shows mod_php being exploited, which is not being used by any decent devops.

So I don't think its a major issue, all web servers I know moved to php-fpm a decade ago?

[u/sleemanj → u/Maria_Thesus_40]

It shows mod_php being exploited because their test setup used mod_php.

If the vector is as given in the various X leaks, then it won't matter how PHP is run, it's in the handling of file uploads and interaction with the upload_progress function of session handling - which is enabled by default.

Or possibly with the parsing of multipart submissions.

For safety, best to disable upload_progress, and probably use mod_security to block requests including parameter called PHP_SESSION_UPLOAD_PROGRESS

If it's in multipart parsing, that's more difficult to mitigate.

[u/Maria_Thesus_40 → u/sleemanj]

I disabled upload_progress a few hours ago, thank you for the extra details!

[u/richmondavid → u/Maria_Thesus_40]

PHP-FPM is also affected. All PHP backends. There's just no public proof of concept to it, but the developers said that, looking at the source code, it should affect FPM as well.

[u/asdf_lord]

great

[u/Anongirl55959]

Ive seen a handful of sites go offline while they do this

[u/revcraigevil]

https://deb.sury.org/

[u/lkraav]

> Information for build php-8.0.30-9.el9,draft_133341

Draft build seems green https://kojihub.stream.centos.org/koji/buildinfo?buildID=133341 but how long usually to promote to stable?

[u/carlwgeorge → u/lkraav]

It varies, but this one looks to have been promoted from draft pretty quickly and is already available from the appstream repo.

carl grey ~ 
❯ koji -p stream list-history --build php-8.0.30-9.el9
Wed Oct 21 10:56:02 2026 php-8.0.30-9.el9 tagged into c9s-draft by osci-distrobuildsync
Wed Oct 21 13:42:39 2026 php-8.0.30-9.el9 untagged from c9s-draft by gating-bot
Wed Oct 21 13:42:39 2026 php-8.0.30-9.el9 tagged into c9s-candidate by gating-bot [still active]
Wed Oct 21 13:43:36 2026 php-8.0.30-9.el9 tagged into c9s-pending by gating-bot [still active]
Wed Oct 21 13:48:37 2026 php-8.0.30-9.el9 tagged into c9s-pending-signed by autorpmsign/signer02.stream.rdu2.redhat.com [still active]

root@c9:~# dnf -q rq --nvr --latest-limit 1 php-common
php-common-8.0.30-9.el9

[u/EdmontonSignals]

Alpine packages have been updated

[u/elatllat → u/EdmontonSignals]

Thanks, looks like they are 6th place.

[u/output_broadcast]

Apparently Gentoo has pushed the update at 13:40.

Also Guix at 14:05.

[u/aKtaKo]

That gentoo link isn't right. It's linking to the binpackages, not the actual gentoo repo. A repo mirror is here. If I install php right now it gives me 8.3.36.

[u/rklrkl64]

First to update will be Remi's repo at https://rpms.remirepo.net/

Update: Remi updated about 10 mins before the 14:00 UTC embargo was lifted, so I was probably correct (got downvoted for no real reason!).

Unfortunately, this wasn't enough time for all the mirror sites to pick up the update, so I commented out the mirrorlist line in remi-safe.repo and uncommented the baseurl line, which got the updates far more reliably.

[u/haHAArambe → u/rklrkl64]

It's sounding like Remi won't even have a patch out today.

Edit: Remi has updated! https://github.com/remicollet/remirepo/issues/351

[u/DiligentPhotographer → u/[deleted]]

I still don't see it on my side for 8.3 at least.

[u/Illustrious_Mango424 → u/[deleted]]

Are you on RHEL 9 or 10? I'm not seeing it for 10 yet.

ETA: I'm also seeing them after doing:
dnf clean all
dnf check-update "php*"

[u/_Kastle → u/Illustrious_Mango424]

It's on 10 for me. Had do do a `dnf clean all` to get it to show up.

[u/notemaker]

Fedora reportedly has updated packages:

https://bugzilla.redhat.com/show_bug.cgi?id=2556842

[u/elatllat → u/notemaker]

I don't see it yet.

[u/notemaker → u/elatllat]

According to the last post in the link above, it may not be available on mirrors yet:

Packages are available, see https://bodhi.fedoraproject.org/updates/?packages=php

If the new packages are currently not available on your mirror, you may download the packages from koji (see link above). Then install the package files using dnf. Example (read BUILD_NUMBER from koji webpage): "koji download-build BUILD_NUMBER --arch=x86_64"

[u/elatllat → u/notemaker]

installing a package not from the main repo can be done on any distro at any time. The point is which distro has critical fixes first to minimize downtime.

[u/TampaPowers]

Canonical apparently fast asleep on this, so much for the whole security marketing