Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming 89 points by petecooper10 hours ago | hide | past | favorite | 20 comments A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10.0. I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority. These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards. These are the two reserved CVEs for the reported upcoming announcement: CVE-2026-109618 CVE-2026-109619 help 
lol76822 minutes ago | next[–] There comes at point at which it is better for everyone to just disclose the details and pursue Full Disclosure. I think we reached that point hours ago. It has been incredibly frustrating watching Twitter and that (potentially, I don't know how reliable the leaks are) being a better information source than anything else, at least so that those of us hosting stuff ourselves can try and explore if there are any defensive measures that can be put in place in lieu of any actual fixed builds being released. I suspect this is already being actively exploited now. https://x.com/J4ck3LSyN/status/2112703096443097263 reply jwitthuhn10 minutes ago | parent | next[–] Seems like some of the people engaging in "responsible disclosure" were not very responsible and it leaked out. With that info public they do really need to just release the fix, assuming that tweet is accurate. reply potaytopotahto30 minutes ago | prev | next[–] Looks like details about the exploits have already leaked on twitter, if the info is correct then it can be mitigated by setting session.upload_progress.enabled = Off until you get the opportunity to update reply phab1 hour ago | prev | next[–] Tweet allegedly showing exploit at work: https://x.com/k_firsov/status/2112641845926989944 (video). Yikes reply ShowalkKama4 hours ago | prev | next[–] Those CVEs refer to vulnerabilities in wordpress plugins (not php) and the vulnerabilities are not RCEs. Am I missing something? https://nvd.nist.gov/vuln/detail/cve-2026-9618https://nvd.nist.gov/vuln/detail/cve-2026-9619 reply dylanpyle4 hours ago | parent | next[–] It sounds like the upcoming ones are 2026-109618/109619, not 9618/9619 reply ShowalkKama4 hours ago | root | parent | next[–] I even double checked, I'm so blind. reply lioeters18 minutes ago | prev | next[–] This vulnerability has already been reproduced by a third party with LLM assist. And of course they posted the details on Twitter - and someone else posted the link here just now. So the cat's out of the bag. That means roughly 70% of all websites (WordPress, Laravel, Drupal, Joomla, Magento) are currently open to remote code execution. About half of that is running an older PHP 5 and 7 that apparently will not receive the urgent security patch. > Two heap use-after-free primitives in PHP's session.upload_progress handler Guess it's time to rewrite PHP in Rust. Claude, make no mistakes, you can do it! reply archon8101 hour ago | prev | next[–] Here's the alleged demo video. It's called php2shell https://x.com/k_firsov/status/2112641845926989944 and it's scary as hell. reply HotGarbage4 hours ago | prev | next[–] https://www.php.net/archive/2026.php#2026-10-20-1 reply kevinday1 hour ago | prev | next[–] Quick correction to the text above, PHP says the patch/announcement will be available Wednesday, 21 October 2026 at 14:00 UTC. https://www.php.net/archive/2026.php#2026-10-20-1 reply gnabgib10 minutes ago | parent | next[–] Yes it's now Wednesday, but Thursday was originally correct. Because of this HN post, it's been moved up to tomorrow. reply unreal373 hours ago | prev | next[–] This was supposed to be embargoed. So your reliable source can't keep a secret. reply reddalo4 hours ago | prev | next[–] Official statement released by PHP: https://www.php.net/archive/2026.php#2026-10-20-1 Statement by CERT-EU: https://cert.europa.eu/publications/security-advisories/2026... : >Where immediate patching is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix is available. It seems serious. Well, good luck isolating all PHP applications from the public internet... reply SchizoDuckie6 hours ago | prev[–] Well great thanks. I need details now. Where, core? Extensions? What config? My guess is on some request filtering thing reply reddalo4 hours ago | parent | next[–] Yes, it's on core. All versions from PHP 5 onwards. Only PHP 8 will be patched. reply joshuat2 hours ago | root | parent | next[–] So a few million WordPress sites are just going to be overnight targets. Although I guess that's not a dramatic change in the status quo. reply Yiin45 minutes ago | root | parent | prev | next[–] surely not only 8, that would be insane reply rpeden20 minutes ago | root | parent | next[–] Everything before 8.2 is past EOL. reply dwm4 hours ago | parent | prev[–] Details are due for disclosure at 1400hrs UTC tomorrow. That timeline may yet change. reply
Consider applying for YC's Winter 2027 batch! Applications are open till November 2. Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact Search: