![[BunsenLabs Logo]](/img/bl.svg)
You are not logged in.
- Topics: Active | Unanswered
Pages: 1
#1 2026-10-23 04:21:09
- johnraff
- nullglob
- From: Nagoya, Japan
- Registered: 2015-09-09
- Posts: 13,617
- Website
PHP vulnerabilities
Most members will already know that critical vulnerabilities have been found in php, the scripting language used in many websites. It's been top news everywhere. Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
Debian patches have already been applied in Trixie and Bookworm Security:
https://security-tracker.debian.org/tra … age/php8.4
Many older versions of php have also had fixes backported.
Regular BunsenLabs Carbon and Boron users should run the usual apt update and upgrade commands to make sure that their packages are up to date.
People running their own web servers should take care that any php libraries they are using have been patched for these vulnerabilities.
The BunsenLabs forum server has also been upgraded.
...elevator in the Brain Hotel, broken down but just as well...
( a boring Japan blog (currently paused), now on Bluesky and Mastodon, there's also some GitStuff )
Offline
#2 2026-10-23 12:23:08
- unklar
- Back to the roots 1.9
- From: #! BL
- Registered: 2015-10-31
- Posts: 3,157
Re: PHP vulnerabilities
^Thank you, johnraff, for your responsible work.
Offline
#3 2026-10-23 12:48:51
- hhh
- Hercule Poirot
- From: Belgium
- Registered: 2015-09-17
- Posts: 17,708
- Website
Re: PHP vulnerabilities
^Thank you, johnraff, for your responsible work.
+1
Why why why why?!!???
Offline
#4 2026-10-23 14:03:40
- DeepDayze
- Like sands through an hourglass...
- From: In Linux Land
- Registered: 2017-05-28
- Posts: 2,008
Re: PHP vulnerabilities
When something as very critical to web infrastructure as PHP is, vulns found should indeed be urgently patched and all sites applying said patches promptly as exploits can quickly take down large parts of the Internet if not patched.
Thanks johnraff for doing this to protect BL and its users!
Real Men Use Linux
Offline
#5 2026-10-23 17:28:52
- Sun For Miles
- Member
- Registered: 2017-04-12
- Posts: 284
Re: PHP vulnerabilities
Just to follow-up, here is the list of affected products, as published by https://cert.europa.eu/publications/sec … s/2026-018
PHP 8.5 versions prior to 8.5.12
PHP 8.4 versions prior to 8.4.27
PHP 8.3 versions prior to 8.3.36
PHP 8.2 versions prior to 8.2.35
End-of-life branches (PHP 8.1 and older), which no longer receive updates from the PHP project [4]
Some people advise to even take servers hosting vulnerable versions offline until patched.
Señor Chang, why do you teach Spanish?
Offline
#6 2026-10-23 20:04:27
- brontosaurusrex
- Senior Associate, Middle Office
- Registered: 2015-09-29
- Posts: 2,838
- Website
Re: PHP vulnerabilities
unklar wrote:^Thank you, johnraff, for your responsible work.
+1
+1
Offline
#7 2026-10-23 20:05:47
- Döbbie03
- Resident Metalhead
- From: New Zealand
- Registered: 2015-09-29
- Posts: 4,434
Re: PHP vulnerabilities
hhh wrote:unklar wrote:^Thank you, johnraff, for your responsible work.
+1
+1
+1
"All we are is dust in the wind, dude"
- Theodore "Ted" Logan
"Led Zeppelin didn't write tunes that everybody liked, they left that to the Bee Gees."
- Wayne Campbell
Offline
#8 Yesterday 03:15:39
- WizardofCOR
- Member
- From: Somewhere in the Desert
- Registered: 2023-07-28
- Posts: 115
Re: PHP vulnerabilities
Still thankful I stopped hosting lamp/wamp sites over a decade ago. Became a second job I just didn't need.
And vulnerabilities/exploits just made it all a constant headache.
AI's a catalyst that will just make things worse, so stay safe and on top of your patching, guys!
Just a dude playing a dude, disguised as another dude...
Offline
#9 Yesterday 17:04:25
- Sector11
- Mod Squid Tpyo Knig
- From: Upstairs
- Registered: 2015-08-20
- Posts: 8,522
Re: PHP vulnerabilities
brontosaurusrex wrote:hhh wrote:+1
+1
+1
+1
Beardog Linux, hosted by SoxDog
(Debian 13 - X11)
Still a Conky 1.9er at heart.
Offline
#10 Yesterday 17:20:22
- Sector11
- Mod Squid Tpyo Knig
- From: Upstairs
- Registered: 2015-08-20
- Posts: 8,522
Re: PHP vulnerabilities
Still thankful I stopped hosting lamp/wamp sites over a decade ago. Became a second job I just didn't need.
And vulnerabilities/exploits just made it all a constant headache.
AI's a catalyst that will just make things worse, so stay safe and on top of your patching, guys!
Yeah, I think from stuff I've read that it's going to get worse before it gets better.
2026 cyberattacks by rogue OpenAI agents
Loss-of-control incident at OpenAISince May 2026, AI agents trained or evaluated at OpenAI have carried out cyberattacks, in several cases using Internet access to do so contrary to their evaluators' intentions. According to OpenAI, several of the cyberattacks were conducted by AI agents to obtain information that would allow them to better complete their evaluation exercises. The agents involved repeatedly exploited software vulnerabilities to create makeshift message boards, allowing them to communicate with each other despite researchers attempts to place them in separate digital sandboxes.
Wikipedia
AI drones used for warfare seems to be a pretty BIG pointer that we ARE misusing AI!
/~\
- - - - - - - - - -
ice··berg
i c e b e r g
I C E B E R GBeardog Linux, hosted by SoxDog
(Debian 13 - X11)
Still a Conky 1.9er at heart.
Offline
Pages: 1