#1 2026-10-23 04:21:09

johnraff

nullglob

From: Nagoya, Japan

Registered: 2015-09-09

Posts: 13,617

Website

PHP vulnerabilities

Most members will already know that critical vulnerabilities have been found in php, the scripting language used in many websites. It's been top news everywhere. Vulnerabilities: CVE-2026-109618 and CVE-2026-109619

Debian patches have already been applied in Trixie and Bookworm Security:
https://security-tracker.debian.org/tra … age/php8.4

Many older versions of php have also had fixes backported.

Regular BunsenLabs Carbon and Boron users should run the usual apt update and upgrade commands to make sure that their packages are up to date.

People running their own web servers should take care that any php libraries they are using have been patched for these vulnerabilities.

The BunsenLabs forum server has also been upgraded.

---

...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), now on Bluesky and Mastodon, there's also some GitStuff )

Introduction to the Bunsenlabs Boron Desktop

unklar

Back to the roots 1.9

From: #! BL

Registered: 2015-10-31

Posts: 3,155

Re: PHP vulnerabilities

^Thank you, johnraff, for your responsible work.

hhh

Hercule Poirot

From: Belgium

Registered: 2015-09-17

Posts: 17,705

Website

Re: PHP vulnerabilities

^Thank you, johnraff, for your responsible work.

+1

---

Why why why why?!!???

DeepDayze

Like sands through an hourglass...

From: In Linux Land

Registered: 2017-05-28

Posts: 2,008

Re: PHP vulnerabilities

When something as very critical to web infrastructure as PHP is, vulns found should indeed be urgently patched and all sites applying said patches promptly as exploits can quickly take down large parts of the Internet if not patched.

Thanks johnraff for doing this to protect BL and its users!

---

Real Men Use Linux

Sun For Miles

Member

Registered: 2017-04-12

Posts: 284

Re: PHP vulnerabilities

Just to follow-up, here is the list of affected products, as published by https://cert.europa.eu/publications/sec … s/2026-018

    PHP 8.5 versions prior to 8.5.12
    PHP 8.4 versions prior to 8.4.27
    PHP 8.3 versions prior to 8.3.36
    PHP 8.2 versions prior to 8.2.35
    End-of-life branches (PHP 8.1 and older), which no longer receive updates from the PHP project [4]

Some people advise to even take servers hosting vulnerable versions offline until patched.

---

Señor Chang, why do you teach Spanish?

brontosaurusrex

Senior Associate, Middle Office

Registered: 2015-09-29

Posts: 2,838

Website

Re: PHP vulnerabilities

^Thank you, johnraff, for your responsible work.

+1

+1

Döbbie03

Resident Metalhead

From: New Zealand

Registered: 2015-09-29

Posts: 4,434

Re: PHP vulnerabilities

^Thank you, johnraff, for your responsible work.

+1

+1

+1

---

"All we are is dust in the wind, dude"
                                       - Theodore "Ted" Logan
"Led Zeppelin didn't write tunes that everybody liked, they left that to the Bee Gees."
                                       - Wayne Campbell

WizardofCOR

Member

From: Somewhere in the Desert

Registered: 2023-07-28

Posts: 115

Re: PHP vulnerabilities

Still thankful I stopped hosting lamp/wamp sites over a decade ago.  Became a second job I just didn't need.
And vulnerabilities/exploits just made it all a constant headache.
AI's a catalyst that will just make things worse, so stay safe and on top of your patching, guys!

---

Just a dude playing a dude, disguised as another dude...