PHP Foundation发布了PHP 8.5.12、8.4.27、8.3.36和8.2.35版本，修复编号为CVE-2026-109618和CVE-2026-109619的两个关键安全漏洞1。这两个漏洞位于内存管理和错误处理部分，允许未认证攻击者在运行PHP的服务器上执行任意代码1。PHP开发团队表示"所有PHP用户强烈建议立即更新"3。
两个漏洞在2024年由Quarkslab进行的外部安全审计中首次发现，该审计由Sovereign Tech Agency资助1。Calif于7月30日开始审计工作，8月11日发现了远程代码执行漏洞1。OpenAI在同日独立发现了相同漏洞，之后Wiz（8月24日）和Trail of Bits也发现了相关问题1。已有早期攻击出现3，Cloudflare首席技术官Dane Knecht表示"我们看到早期攻击出现"3。修复过程因兼容性权衡和资源限制导致延迟数月，后经多个安全团队发现具体利用方式后才加速推进1。
10月20日15:00 UTC，CVE编号和错误CVSS评分（标注为10.0，实际为9.2）在论坛泄露1。10月21日07:41 UTC，Chainguard单方面破坏保密协议发布修复版本，早于协调披露6小时1。NSA声明，如无法立即更新，建议组织将系统离线3。白宫表示上周已获悉此问题，美国联邦机构正在评估影响3。法国、德国、比利时、荷兰等国政府网站已下线3，维基媒体基金会作为预防措施已关闭多个系统3。
PHP Foundation在5月创建了生态系统安全团队，7月Alexandre Daubois加入，9月Daniel Scherzer加入1。自7月1日以来，PHP安全团队已发布15个CVE，并处理了超过100份无效、重复或无法复现的报告1。
The PHP Foundation has released updated versions addressing two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated attackers to execute arbitrary code on servers running PHP 13. The patched versions—PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35—became available on October 21 13. The vulnerabilities, discovered during a 2024 security audit conducted by Quarkslab and funded by the Sovereign Tech Agency, reside in memory management and error handling components 1.
The initial audit by Calif began on July 30, with the remote code execution flaw identified on August 11 1. OpenAI independently reported the same vulnerability the same day, followed by discoveries from Wiz on August 24 and Trail of Bits 1. Multiple security organizations have recommended immediate updates, with the NSA advising organizations unable to patch immediately to take affected systems offline 3. Early attacks leveraging these vulnerabilities have been observed 3. Governments in France, Germany, Belgium, and the Netherlands have taken their websites offline as a precaution, and the Wikimedia Foundation has similarly shut down multiple systems 3.
The disclosure timeline faced complications when Chainguard unilaterally breached the coordinated disclosure agreement on October 21 at 07:41 UTC, releasing fixes six hours ahead of schedule 1. Earlier that day, CVE numbers and inaccurate CVSS scores (listed as 10.0 instead of the actual 9.2) had leaked in forum discussions at 15:00 UTC on October 20 1. The PHP security team has been responding to heightened vulnerability activity since July 1, publishing 15 CVEs while handling over 100 invalid, duplicate, or irreproducible reports 1. The Foundation established its ecosystem security team in May, with Alexandre Daubois joining in July and Daniel Scherzer in September 1.
评论
还没有评论，欢迎留下第一条。