> Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor.
Why is the description of "RCE via OOM corruption" mentioning all these settings like memory_limit, post_max_size, max_input_nesting_level etc under "Mitigation" but not blocking multipart requests? Isn't that a solution?
The description of the vurnurability "Several multipart parsing problems" makes it sound like it is?
PHP runs literally half the web. Half the web will not apply this patch in any reasonable amount of time (a huge portion will never). This is going to be absolutely catastrophic.
The union of hosters which will not update to this patch, and users who have not updated to the past 283762 CVE is literally the same circle. I think that maybe a couple new not infected machines will get infected with a cryptominer - the rest will just get one new miner fighting for resources
With AI agents, I've been using sites/services that are bot friendly and don't require MFA.
Not everything needs hyper security. Heck, I've given AI access to spend money on websites and my only restriction is that the websites limit the daily spend(website side... Although I guess a rogue AI could have changed it... )
For anyone who can't patch their PHP for some reason, here is a proxy that eliminates the threat for you -- it's open source, you can add it to your servers:
https://github.com/Qbix/proxy -- open source MIT licensed, I made github actions compile it as a Cosmopolitan binary so it can work across many operating systems (thanks Justine)
It should work with all top servers (nginx, apache, caddy etc)
> out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
If only we could come up with a way to manage memory automatically. Alas, one can only dream.
I'm pretty sure this class of problem would exist in GC'd environments too unless they're configured to abort on OOM, in which case you'd still be dealing with denial-of-service.
In some environments OOM is a trappable exception, so it's possible that incorrectly authored code would trap the OOM and 'recover' with partially initialized data sitting on the heap. Hopefully it's a memory-safe language so that partially initialized data isn't RCE...
No, the entire world abandoned it when you realized it wasn't the perfect language. The rest of us are just role playing today basically. It's a bit of a lark, kind of like civil war reenactment.
how does Docker not yet have a new, official PHP image ready, given such a big heads up? https://hub.docker.com/_/php Nuts this wasn't ready to flip on at :00 (or even earlier given the PoC exploit and even the official PHP fixes were out well before). Now we are 27 minutes past due.
Just pulled the new matomo that was published on dockerhub 26 minutes ago, thinking it has the patched PHP version:
# docker pull matomo:latest
latest: Pulling from library/matomo
Digest: sha256:6e63589d31ec653f78e029084d21488640fdbbd9a42c96c872098f42c8678a02
Status: Image is up to date for matomo:latest
docker.io/library/matomo:latest
# docker run --rm matomo:latest php --version
PHP 8.4.26 (cli) (built: Oct 21 2026 00:31:19) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.26, Copyright (c) Zend Technologies
with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
The PHP build is from today, which is doubly misleading. 8.4.27 is the patched release, not 8.4.26. I wonder how many people will pull this image thinking they're good to go online again.
The "official" PHP Docker images turned out to be a shit show tody. Seems like many maintainers fell for it and published updates that aren't really updates.
I'm currently waiting for a new docker image for another project, and their maintainer noticed the old PHP versions in the freshly built images and is still waiting or working on releasing a new container build.
Fully agree. Moved to FrankenPHP's static build (which was ready very quickly) to get away from it. Don't intend to ever use the "official" images again.
"Let's use this packaging some rando on the Internet built" is a strategy that is exactly as good as it seems, but that's the Docker ecosystem for you.
Packers who actually understand the software put in good work to package that software in small and well maintained packages. Use them!
I had to build and deploy my own Nextcloud images earlier today. :( Not a big deal because docker, just obnoxious that this got released into the wild and was being actively exploited before patches were available everywhere.
71 comments
[ 1.4 ms ] story [ 27.6 ms ] threadThough quite possibly I'm missing something ;)
---------------
edit: as I was typing the index was updated. So, as far as I can tell only just now (18:20 UTC) was it available for updating!
EDIT: looks like there are backports though
The description of the vurnurability "Several multipart parsing problems" makes it sound like it is?
blog that was helpful to me: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
Hehe. That's funny.
I can imagine a truce, either on machines ('ok, you take that one') or on cores ('16/8, deal?')
This is very entertaining writing on that subject:
https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm....
Not everything needs hyper security. Heck, I've given AI access to spend money on websites and my only restriction is that the websites limit the daily spend(website side... Although I guess a rogue AI could have changed it... )
https://news.ycombinator.com/item?id=50180987
https://github.com/Qbix/proxy -- open source MIT licensed, I made github actions compile it as a Cosmopolitan binary so it can work across many operating systems (thanks Justine)
It should work with all top servers (nginx, apache, caddy etc)
Unclear why Ubuntu is lagging.
This adds Ondřej Surý's PPA to your system so you can upgrade the packages.
https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.2...
https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.2...
but nothing shipped yet by their mirrors, unlike debian.
They gave away CDs 20 years ago for free. Cooool.
Fedora is best for desktop.
Debian for servers that never need updates (but I even use Fedora for server now adays)
Debian on the desktop is the best computer decision I ever made
Ubuntu literally stole debian, added own wallpaper and started selling it as its own distro.
https://blog.okturtles.org/2024/10/convert-wordpress-to-stat...
If only we could come up with a way to manage memory automatically. Alas, one can only dream.
In some environments OOM is a trappable exception, so it's possible that incorrectly authored code would trap the OOM and 'recover' with partially initialized data sitting on the heap. Hopefully it's a memory-safe language so that partially initialized data isn't RCE...
Ever heard of WordPress?
This hurts because my resume has laravel and WordPress on it. I built sooo many sites/apps on it.
With AI agents, I just can't imagine using PHP anymore unless I'm patching legacy stuff.
I loved laravel too... WordPress, love hate.
they are wanting people to pay for the hardened version.
So far, no dice.
I'm currently waiting for a new docker image for another project, and their maintainer noticed the old PHP versions in the freshly built images and is still waiting or working on releasing a new container build.
"Let's use this packaging some rando on the Internet built" is a strategy that is exactly as good as it seems, but that's the Docker ecosystem for you.
Packers who actually understand the software put in good work to package that software in small and well maintained packages. Use them!
apt upgrade