Mmastodon TechnologyCybersecurity first seen 15 d ago, last 15 d ago, peak #2
PHP Foundation admits security fix stalled for months
Original: The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for mo
The PHP Foundation says the first signs of the flaw behind CVE-2026-109618 appeared in 2024, but the fix stalled for months in what it calls 'a structural failure.' Patched releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address it and CVE-2026-109619, both unauthenticated remote code execution bugs rated 9.2 on the CVSS scale. Chainguard is credited with helping surface the issue.
Why now: The unusually candid admission of an internal process failure, combined with critical remote code execution vulnerabilities, is drawing attention from the security community.
PHP FoundationCVE-2026-109618CVE-2026-109619ChainguardPHP
Evidence
- The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke… · technotenshi@infosec.exchange · 2
API: https://socialmediatrends-api.osmike.com/v1/trends/3196632