Upcoming critical PHP security release (CVE-2026-109618 / -109619)
https://news-web.php.net/php.announce/509loading story #50177520
loading story #50176957
loading story #50177435
loading story #50175654
loading story #50175410
loading story #50177472
I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.
loading story #50177214
How can I try this to see if I should shut things down myself. I run a 6 figure stealth and have a day job for fintech in 9 figures all php so kinda worried
loading story #50176025
loading story #50176135
loading story #50176889
loading story #50174090
loading story #50175270
Two things you can do now:
1. Turn off session upload progress
2. Block multipart requests at the web server
More info: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
loading story #50176320
loading story #50177371
loading story #50177385
loading story #50176630
loading story #50175454
loading story #50175561
loading story #50176332
Took a quick peak at the relevant C code and what I think are the offending lines seem somewhat suspicious right off the bat.
Fil-C should have caught this right? I wonder if it would benefit the PHP ecosystem as a whole if the releases are built with it instead.
PHP as it is desperately needed the speedups in the 7 and 8 series releases to be relevant, performance loss of that magnitude is simply not going to be accepted anywhere
loading story #50176373
loading story #50176190
loading story #50176182
loading story #50175348
loading story #50175397
loading story #50175112
loading story #50176699
loading story #50175889
loading story #50176290
loading story #50176092
loading story #50175986
loading story #50176220
loading story #50176937
loading story #50175556
loading story #50175120
loading story #50175064
loading story #50176017
loading story #50176545
loading story #50175476
loading story #50176368
loading story #50176432
loading story #50175601
loading story #50177168
loading story #50175629
loading story #50174902
loading story #50176359
loading story #50175985
This might be the nail in the coffin for php.
loading story #50176183
loading story #50175773
loading story #50176045
loading story #50175768
loading story #50176214
loading story #50176044
loading story #50176444
loading story #50176725
loading story #50176173