PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). CVE-2026-109618 arises from out-of-memory handling that can interrupt request processing while internal request data is only partially initialized, allowing cleanup to treat invalid data as valid. CVE-2026-109619 involves stale global state where request-owned internal state can persist after its backing memory is freed and be reused by a later request. All web-facing PHP deployments are at risk (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), with mod_php assessed as highest risk due to a demonstrated exploit that can run before application code executes. There are no complete mitigations; updating is the only safe solution.
Immediate actions recommended include updating to the fixed releases (downloads and vendor packages available) and checking vendor-supplied updates; PHP 8.1 and older no longer receive official updates, though minimal source backports were provided to help building fixes for 7.4-8.1. Short-term mitigations (partial and not fully protective) include setting memory_limit=-1 and limiting post_max_size/upload_max_filesize, using container or cgroup availability boundaries (not RLIMIT_AS/RLIMIT_DATA), disabling session.upload_progress, setting fatal_error_backtraces=0 on 8.5, removing per-request diagnostics, and fixing attacker-reachable fatal errors/timeouts. PHP 8.2 reaches end-of-life on 31 December 2026; test-only PHP 8.6.0 RC3 is also available.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.