Potential third critical PHP CVE
mpaepper
64 points
16 comments
October 21, 2026
Related Discussions
Found 5 related stories in 123.7ms across 10,209 title embeddings via pgvector HNSW
- Critical Vulnerabilities in PHP defly · 21 pts · October 20, 2026 · 78% similar
- Upcoming Critical PHP Security Release choult · 117 pts · October 20, 2026 · 75% similar
- Upcoming critical PHP security release xd · 412 pts · October 20, 2026 · 73% similar
- Upcoming Critical PHP Security Release (CVSSv4 score of 9.2) kacy · 16 pts · October 20, 2026 · 72% similar
- Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming petecooper · 145 pts · October 20, 2026 · 68% similar
Discussion Highlights (10 comments)
tiku
Got really triggered... By the font.
mvac
PHP is having a really bad day today
yjftsjthsd-h
Oh, it's going to be one of those weeks.
hannob
From the little info one can see here, it looks like this is a PHP script causing a memory corruption. So you probably need to be able to run PHP code to exploit it. That's... not a particularly unusual issue. PHP has a large codebase, releases with plenty of fixed crashes come out regularly. It becomes critical if there's a remote path to exploitation. I see no indication that this is a "critical" PHP flaw. And the Reply from the person who found it seems to confirm that. ("I keep getting asked about mitigations, here's the mitigation: don't worry about it kitten")
selckin
https://www.openwall.com/lists/oss-security/2026/10/21/23
rvz
I mean it the first time [0], PHP is done. [0] https://news.ycombinator.com/item?id=50181423
bawolff
There is literally no info on how this is triggered. From the info this could range anywhere from total non issue to zOMG. Given how keyed up everyone is, i lean towards the former. honestly, i would just wait for php announcement and assume its no big deal until then.
nr378
That post appears to show the same stack trace as this reported issue https://github.com/php/php-src/issues/24488 , which is a confirmed GC regression in 8.5.12 but it is not exploitable (the allocator's shadow protection kills it), and it does not result in RCE and is not a critical CVE. It's a very different shape to the other two CVEs, and a use-after-free doesn't necessarily immediately imply a critical CVE.
athrowaway3z
I've spent some deepseek tokens on trying to reproduce this CVE with what is known so far; (Very little beyond effected versions and a hint that her search started because of the current bug, but that it's probably a different one entirely). It found nothing. Take that for what it is. Together with https://www.openwall.com/lists/oss-security/2026/10/21/23 you're probably not going to need to stay up for this.
ChrisArchitect
Source thread: https://fedi.katze.sh/@elise/117479383739450605 ( https://news.ycombinator.com/item?id=50182930 )