PHP released an emergency security update across the entire 8.x line addressing two remote code execution vulnerabilities, after coordinated disclosure was compromised by leaked CVE IDs and a security firm accidentally publishing a PoC video. The PHP Foundation accelerated the release timeline in response to the leak, and the incident highlights ongoing challenges in responsible vulnerability disclosure.
Background
PHP is one of the most widely deployed server-side programming languages, powering a significant portion of the web. The PHP Foundation was established to coordinate security research and responsible disclosure for the language.
- Source
- Simon Willison
- Published
- Oct 22, 2026 at 02:41 AM
- Score
- 7.0 / 10