"Security Advisory 2026-018" – Critical Vulnerabilities in PHP 5+

[Knubbi]

Seems to be huge. Any feedback on this?

"On 20 October 2026, the PHP foundation announced an upcoming security release addressing two critical vulnerabilities in PHP that could lead to remote code execution, according to other leaks [1,2,3]."

Source: https://cert.europa.eu/publications/security-advisories/2026-018/

[Knubbi]

Our hosting provider shuts everything down to apply updates. This appears to be a significant update.

[teppo]

7 hours ago, Knubbi said:

Seems to be huge. Any feedback on this?

It is a major issue. Around here many public and private services alike are currently down, while patches are pending. It's that serious.

I am still waiting for an update, and as such e.g. weekly.pw is currently (intentionally) down.

I can't stress this enough: if anyone here maintains their own servers, this is absolutely massive issue. It might very well be better to take your site(s) down until you can patch PHP.

[eelkenet]

Major major indeed. Even the official Dutch cybersecurity agency had their website shut down.