PHP 8.2.35
PHP has released version 8.2.35 to patch two critical remote code execution vulnerabilities, sending developers scrambling to update their systems. The urgency is amplified by concerns over slow official Docker image releases and delayed package manager updates, leaving many exposed. This incident also sparks debate on coordinated disclosures, the role of AI in finding bugs, and PHP's long-standing security reputation.
The Lowdown
The PHP development team has urgently released PHP 8.2.35, a crucial security update addressing two severe vulnerabilities (CVE-2026-109618, CVE-2026-109619). These flaws allow unauthenticated remote code execution, prompting a strong recommendation for all PHP 8.2 users to update immediately, as no complete mitigations exist outside of patching.
- Critical Vulnerabilities: The release fixes two security holes that enable attackers to run arbitrary code on affected servers without authentication.
- Immediate Action Required: PHP users are strongly advised to update their installations without delay, as partial mitigations are not available.
- End-of-Life Reminder: PHP 8.2 will cease receiving security fixes after December 31, 2026, pushing users to plan upgrades to currently supported versions.
- Availability: Source downloads are accessible via the PHP downloads page, which also provides Windows binaries and a detailed ChangeLog.
The severity of these vulnerabilities underscores the importance of prompt updates to maintain system security and integrity across the vast PHP ecosystem.
The Gossip
Patching Panic and Distribution Delays
The immediate aftermath of the security announcement saw widespread frustration over the slow rollout of updated PHP packages and Docker images. Users reported significant delays from official Docker Hub, Ubuntu's `ondrej/php` PPA, and various hosting providers like WP-Engine. Many expressed disbelief that with coordinated disclosure, downstream distributors weren't ready to deploy patches instantly, leading to prolonged exposure for critical systems. The discussion also highlighted how this bottleneck complicates rapid security responses for system administrators.
Disclosure Dilemmas and PR Playbooks
The coordinated disclosure of the vulnerabilities, involving Wiz, Calif, and OpenAI, sparked considerable debate. Commenters questioned the timing and execution, suggesting it felt more like a PR stunt than a smoothly managed security release, especially given the delays in patch availability. Some pointed to previous, related bugs reported years ago, speculating that LLMs might be 'rediscovering' old issues. There was also criticism regarding the 2-month window between discovery and public disclosure, with some arguing the fix should have been released earlier, particularly once rumors and PoCs started circulating. Others defended the coordinated approach as necessary for a global rollout.
PHP's Perennial Puzzles and Prognostications
This critical vulnerability reignited long-standing debates about PHP's fundamental security, its use of `longjmp()`, and its overall architectural choices. Some users declared 'PHP is done,' reflecting a sentiment that the language is inherently vulnerable, drawing parallels to its 'old days' of security issues. Others defended PHP, noting that every language has vulnerabilities and that the vast ecosystem continues to thrive. The conversation also touched on the broader implications of AI-driven vulnerability discovery, pondering whether this signals an era of unprecedented computer worm events and the growing challenge of patching all software flaws.
Community Contributions and Cloud Concerns
Amidst the chaos, the community focused on practical advice and support. Many shared immediate mitigation steps for unpatched servers, while others highlighted the critical work of maintainers like Ondrej Sury (for Ubuntu packages) and Remi (for RedHat derivatives), urging financial support for their often-unpaid efforts. A specific point of contention arose regarding Cloudflare, with some users accusing the CDN provider of misleading clients about their protection against this specific RCE without PHP upgrades, while others pointed to Cloudflare's proactive WAF updates. The discussion also included advice for WordPress users and general best practices for isolating PHP processes.