Update: patches are out. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Everything older is affected, and PHP 7 and 5 won't get a fix (check whether your distro backports it).
The bug: when PHP aborts a request halfway (for example when it runs out of memory), it could later trust internal data that was only half set up. mod_php setups are the most exposed; PHP-FPM is less so, because it kills the worker when a request fails early.
There are already reports of exploit attempts. If you run PHP, update now, not tomorrow.
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-21 15:37:47 UTC
in reply to nevent1q…0f2t
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-21 15:37:47 UTCEvent JSON
{
"id": "c8250ccf46af82242273f06fe39fe710bbc1e50c79ceded2354025cff5f61dc0",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792597067,
"kind": 1,
"tags": [
[
"e",
"228e79e18f7951f0c58099b5ac4239330a30c6efc3e6533d28f345a418edb16b",
"",
"root"
],
[
"p",
"67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1"
]
],
"content": "Update: patches are out. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Everything older is affected, and PHP 7 and 5 won't get a fix (check whether your distro backports it).\n\nThe bug: when PHP aborts a request halfway (for example when it runs out of memory), it could later trust internal data that was only half set up. mod_php setups are the most exposed; PHP-FPM is less so, because it kills the worker when a request fails early.\n\nThere are already reports of exploit attempts. If you run PHP, update now, not tomorrow.",
"sig": "43b21812c98d3474f7a4b1b51ca4f01cf1c082161ac2c2556f8f6a0f734a2c4337a3b8e5d25fe12ed11b311d13b6eca1853869ff6ac45b5bb1c2f921516bc9a1"
}