Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

[Aaron Rainbolt <arraybolt3 () gmail com>]

On Wed, Oct 21, 2026 at 10:24 AM Aaron Rainbolt <arraybolt3 () gmail com> wrote:

...snip...

> While not yet fully confirmed, the Fediverse is reporting that the fix
> to at least PHP 8.5.12 may be incomplete:
> https://fedi.katze.sh/@elise/117479383739450605

According to a conversation in #security:ubuntu.com Matrix, Canonical
asked php.org if the issue mentioned in this Mastodon thread was a
real vulnerability or not, and was told that it's "unrelated and not a
real issue". If someone from the PHP security team could reconfirm
this here, that would be greatly appreciated.

--
Aaron