TBNAI
Today's PHP Security Release, and How We're Strengthening PHP Security
Publication: Simon Willison's Weblog
Author: Not available in collected metadata
Source published: 21/10/2026, 18:41:53 UTC
Briefing created: 21/10/2026, 18:58:48 UTC
Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 21/10/2026, 18:57:24 UTC.
Briefings
A PHP Foundation release on October 21, 2026, fixed two remote code execution vulnerabilities in PHP 8.x that leaked on October 20, 2026. The leak caused a false CVSS score of 10.0 and an incorrect release time, leading to a mistaken video release by a security firm that accelerated proof-of-concept development. The timeline shows the vulnerability was first discovered by Wiz Research on August 19, 2026, before the coordinated fix was implemented.
Key points
- Two remote code execution vulnerabilities in PHP 8.x were exploited on October 20, 2026, with a leaked CVSS score of 10.0 and incorrect release time.
- The PHP Foundation corrected the release time to October 21, 2026, 14:00 UTC and published the patch at 19:30 UTC to prevent further exploitation.
Context
The vulnerabilities were discovered by Wiz Research on August 19, 2026, and reported to the PHP security team on August 24, 2026. The coordinated disclosure process failure led to a false high CVSS score and incorrect release timing, which accelerated the spread of proof-of-concept exploits.
Limitations
The evidence is limited to the provided article and timeline; no additional data on exploit impact, affected systems, or long-term security implications is supplied.
Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 21/10/2026, 18:58:48 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.
View archived briefing on IPFS
bafybeib6dmgrvbzeozxxrk4zvafk56wdydvryi25hnuie56mqo6wnsun6e