Hmmm, PHP had a few critical weaknesses it seems

[Lukraak_Sisser]

From the BBC, though at least in the Netherlands it's big news

Websites taken down as critical PHP cyber-security update issued

Two critical vulnerabilities have been identified with PHP, a programming language which is widely used across the internet.

www.bbc.com

It seems AI found at least two vulnerabilities in PHP, the update is out, but of course also indicates WHAT the vulnerabilities are.
At least in the Netherlands various critical government websites were/are down until the patch is applied.

 

[Wudang]

"

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it."

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

www.ncsc.gov.uk

 

[Norman Alexander]

"

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it."

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

www.ncsc.gov.uk

That second one looks like "fun"!

 

[Wudang]

@icerat

 

[Wudang]

One of the fixes runs to 13k lines. I bet that’s been thoroughly checked and tested.

 

[ISF Staff]

ISF server is now patched

 

[Wudang]

For ◊◊◊◊◊ ◊◊◊◊◊◊◊ sake

Cyber correspondent Joe Tidy says he didn't know PHP existed until yesterday morning - it's "one of these things we take for granted", he says.

BBC news. https://www.bbc.co.uk/news/live/ckgel5xp2xv9t?post=asset:0157ff75-4be5-46d3-885e-ab9b14bbeb9a#post

ETA: confirms my opinion of people who use cyber as a noun

 

[malbui]

For ◊◊◊◊◊ ◊◊◊◊◊◊◊ sake



BBC news. https://www.bbc.co.uk/news/live/ckgel5xp2xv9t?post=asset:0157ff75-4be5-46d3-885e-ab9b14bbeb9a#post

ETA: confirms my opinion of people who use cyber as a noun

Back in my days in academia we were often contacted by the media for interview and comment on cyber issues. There was always discussion of how to pitch things for the drivetime audience, but a far greater challenge was pitching it for the journalists so that any subsequent questions made sense.

 

[malbui]

It has just been pointed out to me that the reporter behind a related article on the news site of the RTS, the public French language broadcaster in Switzerland, is similarly clueless.