Hmmm, PHP had a few critical weaknesses it seems

[Lukraak_Sisser]

From the BBC, though at least in the Netherlands it's big news

Websites taken down as critical PHP cyber-security update issued

Two critical vulnerabilities have been identified with PHP, a programming language which is widely used across the internet.

www.bbc.com

It seems AI found at least two vulnerabilities in PHP, the update is out, but of course also indicates WHAT the vulnerabilities are.
At least in the Netherlands various critical government websites were/are down until the patch is applied.

 

[Wudang]

"

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it."

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

www.ncsc.gov.uk

 

[Norman Alexander]

"

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it."

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

www.ncsc.gov.uk

That second one looks like "fun"!

 

[Wudang]

@icerat

 

[Wudang]

One of the fixes runs to 13k lines. I bet that’s been thoroughly checked and tested.

 

[ISF Staff]

ISF server is now patched