#php

PHP has rebuilt official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a memory corruption vulnerability in the Brotli compression library.

The issue can be reached via the cURL extension when automatic HTTP response decompression is enabled.

Affected packages include versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, incorporating Brotli 1.2.1.

Windows users are advised to update from the official downloads page.

https://en.hacks.gr/nea-paketa-php-gia-ta-windows-diorthonoyn-sovaro-provlima-asfaleias/

#PHP #Brotli #Windows #cURL

Some of you self-hosters might still want to check if you are vulnerable to the PHP2Shell vuln:
https://php2shell.evilbit.de/
#php #php2shell

RE: https://fosstodon.org/@php/117479282535299381

Pretty Himportant Patch (PHP) #php

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

The PHP #security issue shows once again how much our society relies on mostly volunteer work.

Look at PHP Foundation @thephpf finances:
https://opencollective.com/phpfoundation#category-BUDGET

- Reimbursed $67K on development work this year
- Received: $642,755 last year

Compare these numbers with the amounts companies have made with products & services built upon #PHP. Our digital foundations are built on the backs of #opensource volunteers. Governments & companies need to invest in our common digital infrastructures.

@nextcloud
Thx 🤓

CC @Chaotica
CC @selfhtml

#php2shell #nextcloud #webadmin #serveradmin #security #php

High-severity vulnerability in PHP. No patch yet. It’s coming (see @php). It’s recommended to simply shutdown your PHP applications until the patches land (as it involves remote code execution).

#php #security https://fosstodon.org/@php/117474977977509509