Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state

[Nicolas Vigier <boklm () mars-attacks org>]

On Wed, 21 Oct 2026, Aaron Rainbolt wrote:

> On Wed, Oct 21, 2026 at 10:24 AM Aaron Rainbolt <arraybolt3 () gmail com> wrote:
>
> ...snip...
>
> > While not yet fully confirmed, the Fediverse is reporting that the fix
> > to at least PHP 8.5.12 may be incomplete:
> > https://fedi.katze.sh/@elise/117479383739450605
>
> According to a conversation in #security:ubuntu.com Matrix, Canonical
> asked php.org if the issue mentioned in this Mastodon thread was a
> real vulnerability or not, and was told that it's "unrelated and not a
> real issue". If someone from the PHP security team could reconfirm
> this here, that would be greatly appreciated.

https://codeberg.org/oerdnj/deb.sury.org/issues/145#issuecomment-26090654

"The PHP team is aware of that report and there are no new plans as of
now."