297
PSA: PHP warns it plans to release 2 emergency patches imminently (today 14:00 UTC)
(arstechnica.com)
this post was submitted on 21 Oct 2026
297 points (99.3% liked)
Selfhosted
63148 readers
609 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Using a tool like Shodan, I can quickly get a list of addresses that have a specific version of PHP behind it.
It sounds like this is a cvss 9.0 or higher for PHP which is bonkers because PHP is such a huge amount of the internet.
My guess is releasing these CVEs the normal way could have catastrophic consequences. They're giving stsadmins a heads up so there is less of a scramble when sysadmins read "hey fix your shit it's totally vulnerable" before they have their coffee.
Like as a sysadmin, this is a great way for them to do this.
I will in 10 mins alert my team that the whole site has to come offline for a period today. I don't need to take it offline in an emergency and tell my boss to send out a memo.
I wonder how many docker containers keep their own version of PHP...
I can tell you that every docker container we had running was vulnerable, and none had new versions as of around noon today.
The manual fix is relatively easy, just change a few configs.