PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities
that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
This has been in the news and so expect hackers trying their luck! <https://www.php.net/archive/2026.php#2026-10-21-5>
BBC Link:
<https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o>
OpenAI: <https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/>
On 2026/10/22 5:27:50, MegaNZ wrote:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilitiesYes, I've seen and heard the news reports. (You'd have to be fairly dead
that can allow unauthenticated remote code execution. All PHP users are >>strongly encouraged to update immediately.
This has been in the news and so expect hackers trying their luck! >><https://www.php.net/archive/2026.php#2026-10-21-5>
BBC Link:
<https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o>
OpenAI: >><https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/>
not to!)
First time I'd ever heard of PHP.
How do I know if I'm a "PHP user" or not?
On 22/10/2026 in message <11bd22h$s6f5$1@dont-email.me> J. P. Gilliver wrote:
On 2026/10/22 5:27:50, MegaNZ wrote:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilitiesYes, I've seen and heard the news reports. (You'd have to be fairly dead
that can allow unauthenticated remote code execution. All PHP users are
strongly encouraged to update immediately.
This has been in the news and so expect hackers trying their luck!
<https://www.php.net/archive/2026.php#2026-10-21-5>
BBC Link:
<https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o>
OpenAI:
<https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/>
not to!)
First time I'd ever heard of PHP.
How do I know if I'm a "PHP user" or not?
Do you have a website?
First time I'd ever heard of PHP.
How do I know if I'm a "PHP user" or not?
On 2026/10/22 14:24:51, Jeff Gaines wrote:
On 22/10/2026 in message <11bd22h$s6f5$1@dont-email.me> J. P. Gilliver >>wrote:Yes - hand-coded in HTML 3, and not touched for several years!
On 2026/10/22 5:27:50, MegaNZ wrote:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities >>>>that can allow unauthenticated remote code execution. All PHP users are >>>>strongly encouraged to update immediately.Yes, I've seen and heard the news reports. (You'd have to be fairly dead >>>not to!)
This has been in the news and so expect hackers trying their luck! >>>><https://www.php.net/archive/2026.php#2026-10-21-5>
BBC Link:
<https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o>
OpenAI: >>>><https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/>
First time I'd ever heard of PHP.
How do I know if I'm a "PHP user" or not?
Do you have a website?
On 2026/10/22 5:27:50, MegaNZ wrote:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilitiesYes, I've seen and heard the news reports. (You'd have to be fairly dead
that can allow unauthenticated remote code execution. All PHP users are
strongly encouraged to update immediately.
This has been in the news and so expect hackers trying their luck!
<https://www.php.net/archive/2026.php#2026-10-21-5>
BBC Link:
<https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o>
OpenAI:
<https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/>
not to!)
First time I'd ever heard of PHP.
How do I know if I'm a "PHP user" or not?
On 2026/10/22 5:27:50, MegaNZ wrote:
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilitiesYes, I've seen and heard the news reports. (You'd have to be fairly dead
that can allow unauthenticated remote code execution. All PHP users are
strongly encouraged to update immediately.
This has been in the news and so expect hackers trying their luck!
<https://www.php.net/archive/2026.php#2026-10-21-5>
BBC Link:
<https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o>
OpenAI:
<https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/>
not to!)
First time I'd ever heard of PHP.
How do I know if I'm a "PHP user" or not?
The warning then, is mainly for Web Server operators. But
that does not completely eliminate the use of obfuscated
web servers used for UI purposes, locally.
Basically, if a software product was delivered to you with
PHP in it, the "update/upgrade strategy" for the product
would be aggressive and a new version would already have
been pushed out to you. If you ignored the product
warning that "you should remove this version because
it is obsolete and not getting any more updates", then
it's on you to follow the instructions and remove the material.
If you knew something technically about the design, maybe
you wouldn't even bother installing it in the first place :-)
Rickety go-carts are a dime a dozen.
I have not seen specific mentions yet, but I assume that other devices
such as modems, routers, NASs, etc. could use PHP.
On 23 Oct 2026 17:53:35 GMT, Frank Slootweg <this@ddress.is.invalid>
wrote:
I have not seen specific mentions yet, but I assume that other devices
such as modems, routers, NASs, etc. could use PHP.
Possibly. But PHP has a pretty big footprint. I would think these
devices would use something more compact ... like compiled C/C++ code or
CGI scripts to present their admin UI.
Dennis <nobody@nowhere.invalid> wrote:
On 23 Oct 2026 17:53:35 GMT, Frank Slootweg <this@ddress.is.invalid>
wrote:
I have not seen specific mentions yet, but I assume that other devices >>> such as modems, routers, NASs, etc. could use PHP.
Possibly. But PHP has a pretty big footprint.
Well, I mentioned video doorbells as examples which apparently *do*
use PHP. These are, at least physically, rather small devices.
(And, as I said, my NAS has PHP.)
Anyway, what's a gigabyte amongst friends!? (Oops, forgot about RAMageddon.)
On 10/23/2026 2:36 PM, Frank Slootweg wrote:
Dennis <nobody@nowhere.invalid> wrote:
On 23 Oct 2026 17:53:35 GMT, Frank Slootweg <this@ddress.is.invalid>
wrote:
I have not seen specific mentions yet, but I assume that other devices >>> such as modems, routers, NASs, etc. could use PHP.
Possibly. But PHP has a pretty big footprint.
Well, I mentioned video doorbells as examples which apparently *do*
use PHP. These are, at least physically, rather small devices.
Smart Doorbells afiak are not impacted. Consumer IoT is architecturally different - Ring, Google Nest, Arlo, Blink, or Eufy run on embedded
C/C++, Go, or lightweight Python firmware engines rather than PHP
- i.e. no web parsers listening, thus immune to the exploit.
Not doorbell, but a few companies have acknowledged PHP vulnerability
and released patches - Synology(though a need to use specific packages
like Web Station or 3rd party tools like Word Press for a NAS), QNAP - internal web servers.
There has been discussion in the security community about Western
Digital products(e.g. MyCloud) - WD is has not acknowledged anything to
date regarding current OS5 firmware(they might not ever for older
products). For current WD, disabling Remote Cloud Access(UPnP) or
operate behind a home VP for remote- note operating locally with your network is not a concern.
(And, as I said, my NAS has PHP.)
Anyway, what's a gigabyte amongst friends!? (Oops, forgot about RAMageddon.)
And then there are products which use old versions of PHP, which are
no longer supported by the PHP Foundation and hence will not get fixes.
For example my (Synology) NAS [1] still has PHP 6.4 and 7.0.
On 23 Oct 2026 17:53:35 GMT, Frank Slootweg wrote:
[snip]
And then there are products which use old versions of PHP, which are
no longer supported by the PHP Foundation and hence will not get fixes.
For example my (Synology) NAS [1] still has PHP 6.4 and 7.0.
I thought there never was a PHP 6.x
| Sysop: | Tetrazocine |
|---|---|
| Location: | Melbourne, VIC, Australia |
| Users: | 4 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 25:09:18 |
| Calls: | 222 |
| Files: | 21,513 |
| Messages: | 83,563 |