🔴 PHP 严重漏洞被泄露和复现；欧盟机关建议 PHP 服务在修复漏洞前暂时下线。
- PHP 官网称修复会在今日 22:00 (UTC+8) 发布。
- 有说法称 mitigation 是在 php.ini 设置 session.upload_progress.enabled = Off 。
1. https://php.net/archive/2026.php#2026-10-20-1
2. cert.europa.eu/~
3. HackerNews:50167754
CVE: CVE-2026-109618, CVE-2026-109619
linksrc: https://t.me/usr_bin_cat/4464
#php
Telegram 原文
php
或是因为 PHP 漏洞，Pixiv、DeviantArt、Namesilo 等网站暂时停止服务。
距离 PHP 发布 fix 还有约一小时。PHP 8.2 之前的版本已经停止支持，可能不会发布修复。
- https://pixiv.net/
- https://fanbox.cc/
- https://deviantart.com/
- https://namesilo.com/
linksrc: /4938
#PHP #Pixiv #DeviantArt #Namesilo
Telegram 原文
🔴 PHP 发布紧急修复版本 8.5.12/8.4.27/8.3.36/8.2.35。建议受影响网站主立即更新。
- 文章中也提供了无法升级时的 workaround，但它们不能完全修补漏洞。
- Cloudflare 也配置了一些 WAF，但它们也不能完全修补漏洞。 [2]
- PHP 8.1 及更低版本不会被官方修复。
1. https://www.php.net/archive/2026.php#2026-10-21-5
2. developers.cloudflare.com/~
thread: /4940
#PHP
Telegram 原文
🔴 今日漏洞总结。
php [1]：RCE。请更新至 8.5.12/8.4.27/8.3.36/8.2.35。
Node.js [2]：RCE。请更新至 26.12.1/24.22.1/22.23.4。
eMudhra 证书 [3]：或可导致 MitM。请注意停用受影响证书、检查浏览器更新及更新 ca-certificates 等相关组件。测试方法和修复版本参见 [3]。
TiDB 云被骇 [4]：有用户元信息被泄露；但目前没有数据库数据泄露的证据。
1. php.net/~
2. nodejs.org/~
3. https://emudhra.we-have-a-problem.com/
4. pingcap.com/~
#wtf #today #PHP #Nodejs #PKI #PingCAP
Telegram 原文
📣 Announcing the immediate availability of:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
‼️ These address the following critical security issues:
- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)
📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
Windows: https://www.php.net/downloads.php?os=windows
Read more: https://www.php.net/archive/2026.php#2026-10-21-5
Expect quite a few sites to return error pages toay and possibly through the week. Here's my piece on the new PHP zero-day that affects about 70 percent of the Internet. We'll be updating the story with important new developments.
https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/
Edited 2d ago
So today some of the worst people on earth using the most environmentally destructive tools on earth brought down a huge part of the internet by exploiting a potential problem found many years ago in PHP which was previously not practical for anyone to exploit.
It only became "practical" to exploit this problem because "AI" came along to automate the boring and repetitive work required to do so. Absurd amounts of computing power were applied specifically to break into other peoples' websites.
Now the same people who are behind this are trying to pretend that they're heroes for finding an exploit.
"AI uncovers critical vulnerabilities", their headline reads. But the vulnerability was only made to be critical by the very same people as hide behind that headline.
Many thousands of websites are offline, many people are losing money, many thousands of people are working hard to try to patch or work around the problem, many small guys are finding it almost impossible to patch, and we're all supposed to be thankful to OpenAI and others involved ? Nah. Fuck off.
Everything about "AI" involves a lot of externalized costs, but I've still yet to see even a single positive thing that has been achieved by "AI". That has definitely not changed today.
#php2shell #php #fuckai #openai
The PHP #security issue shows once again how much our society relies on mostly volunteer work.
Look at PHP Foundation @phpc finances:
https://opencollective.com/phpfoundation#category-BUDGET
- Reimbursed $67K on development work this year
- Received: $642,755 last year
Compare these numbers with the amounts companies have made with products & services built upon #PHP. Our digital foundations are built on the backs of #opensource volunteers. Governments & companies need to invest in our common digital infrastructures.
I wrote a little bit about my journey to update the PHP License to the Modified BSD License (BSD-3-Clause).
https://ben.ramsey.dev/blog/2026/05/the-php-license-simplified
Can anyone point me to a #PHP presentation (at a user group or conference) that took place earlier than 10 April 1996?
If not, the Linux User Group of Rochester (still active at https://www.lugor.org ) might have the distinction of having hosted the first PHP presentation ever.
https://web.archive.org/web/19961109195847/http://www.lugor.org/lugor-announce/0044.html
I’m not sure what makes this campaign different from other ones in the #PHP community, but there’s no reason we shouldn’t be able to exceed the campaign’s goal and support Joe.
Joe is ranked #14 in number of commits to the PHP source code. That’s out of thousands of contributors. If you use PHP, or any project that depends on PHP, then you’re benefiting from countless hours of work that Joe has contributed to the project.
Please consider donating.
the #pixelfed surge also means a bigger #php footprint in the #fediverse
Help me piece together a complete history of the PHP programming language and its community!
I’m super-excited to announce I’ve been selected to speak at @phptek in May!
I’m giving two talks:
* Internationalization and Localization With PHP
* Return to REST
If you get tickets through this link, you’ll get 10% off, and since Early Bird pricing lasts until the end of this month, this is the lowest price you can get. https://ti.to/phptek/phptek-2025/discount/tek2025
I hope to see you there!
Happy 30th birthday to #PHP. I wrote a history of it several years ago: “If CGI scripts were the start of interactive programming on the web, then PHP was the natural next step — at least on the server-side. Just a month after Brendan Eich created the JavaScript scripting language at Netscape, an independent developer from Canada named Rasmus Lerdorf released the first version of a toolset he called Personal Home Page Tools (PHP Tools).” https://cybercultural.com/p/1995-php-quietly-launches-as-a-cgi-scripts-toolset/
Hey, folks! I’m looking for a Staff Software Engineer to join my team (API Core) at #Mailchimp.
Some of the things we work on: #PHP, #REST, #OpenAPI, #OAuth2, #APIGovernance, and more.
We are stewards of our public #APIs, and we collaborate with other capabilities teams to ensure APIs are developed according to our standards and processes. You would work directly with me on a daily basis.
This position is in Atlanta or New York.
https://jobs.intuit.com/job/atlanta/staff-software-engineer-api-core-team/27595/76329932512
tomkyle/binning – Determine optimal number of bins 𝒌 for #histogram #creation and optimal bin width 𝒉 using various statistical methods in #PHP.
Included methods: Sturges’ Rule, Doane’s Rule, Freedman-Diaconis Rule, Terrell-Scott’s Rule, Rice Rule, Scott’s Rule, and Square Root Rule.
GitHub: https://github.com/tomkyle/binning
Issues: https://github.com/tomkyle/binning/issues
Available on #packagist via #composer. Heavily inspired by markrogoyski/math-php but written for #PHP 8.3+. — #math #statistics
Edited 1y ago
All about the new pipe operator in PHP 8.5:
https://thephp.foundation/blog/2025/07/11/php-85-adds-pipe-operator/
Does anyone use WebHostMost.com? I just heard about it. They have a free tier that doesn’t require credit card info. Can run Node.js, Python apps, PHP.
#Starling is a lightweight #PHP #fediverse server you can install by just copying files over FTP to a shared host. No PostgreSQL, no workers, no DevOps. Owning your data with #ActivityPub can be much simpler than with #ATProtocol. Have you tried it?
https://github.com/dfaria-eu/Starling
#PHP accounts to follow:
OFFICIAL ACCOUNTS
@php - PHP official account
@thephpf - PHP Foundation official account
@drupal - Drupal official account
READING
@phparch - PHP Architect Magazine
@phpreads - Human-curated PHP articles
TOOLS
@Xdebug - PHP debugging extension
@phpunit - Testing framework for PHP
@ddev - FOSS web dev tool for PHP & Node.js sites
@infection_php - Mutation testing library for PHP
🧵 Thread page 1 of 3
https://hachyderm.io/@itworldcup/115926604229775228
PHP was ahead. But at a staggering 1350 votes cast so far, python is pulling ahead again.
And still 10 hours until the poll closes.
Above all, this is testament to the engagement of both the PHP and Python communities.
Perhaps #php is not so dead after all
