PHP 发布安全更新修复两个远程代码执行漏洞，并说明披露流程泄露经过
Today's PHP Security Release, and How We're Strengthening PHP Security
PHP 8.x 全系列发布安全更新，修复两个远程代码执行漏洞；由于协调披露流程出现泄露，漏洞利用代码从昨晚起已在传播。PHP 基金会说明，10 月 20 日两个 CVE 编号带着错误的发布时间和错误的 10.0 CVSS 评分（实际为 9.2）在论坛和社交媒体流传，项目因此把预公告提前到 19:30 UTC 发布，并将发布日期从 10 月 22 日 14:00 UTC 提前到 10 月 21 日 14:00 UTC。Wiz Research 给出的时间线显示，该团队于 8 月 19 日发现首个漏洞，8 月 24 日向 PHP 安全团队报告，10 月 21 日补丁发布并公开披露。
正文
当前显示原文，中文全文译文尚未就绪。
#smallhead
21st October 2026 - Link Blog
Today's PHP Security Release, and How We're Strengthening PHP Security (via) If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since last night, thanks to a leak in the coordinated disclosure process.
This post from the PHP Foundation explain what went so wrong:
On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC [...]
As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.
This article from the team that discovered the original vulnerability includes a more detailed timeline of the original intended responsible disclosure:
August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
October 21, 2026: Patched PHP releases become available.
October 21, 2026: Public disclosure.
Posted 21st October 2026 at 6:41 pm
Recent articles
Battle Drones - a vibe coded RTS with audio-based multiplayer - 20th October 2026
Hello Python 3.15, goodbye 3.10, and now I can use 3.11 - 12th October 2026
A new feature for my blog, built using my voice - 9th October 2026
Claude Haiku 5.5 - 7th October 2026
This is a link post by Simon Willison, posted on 21st October 2026.