Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

[Yves-Alexis Perez <corsac () debian org>]

On Wed, 2026-10-21 at 10:24 -0500, Aaron Rainbolt wrote:
> While not yet fully confirmed, the Fediverse is reporting that the fix
> to at least PHP 8.5.12 may be incomplete:
> https://fedi.katze.sh/@elise/117479383739450605

@elise also sayd it seems like a *different* vulnerability:

https://fedi.katze.sh/@elise/117478655339557825

> ok thinking more about this, there's no way this is the same vuln, this is
> another one.
>
> today is really a day for php.
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part