/dev/null
Sign in

Commit

9f92224

Stephen Rees-Carter@valorin
Something tells me I'm not getting much sleep tonight. This drops at midnight for me. I'll try and keep Securing Laravel updated with any details I'm aware of: https://securinglaravel.com/laravel-security-notice-critical-php-security-release/
QuotingNANils Adermann@naderman
The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wed, Oct 21st 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare to update. Earlier release…
Securing LaravelLaravel Security Notice: Critical PHP Security Release ⚠️[Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.
Adam Hosker@ahosker
Unlucky timing, but given that twitter has a lot of how out already in leaks and accidental disclosures, that time looks optimistic. Half tempted to turn the server off before I go to bed.
Adam Hosker@ahosker
Who knows if the claims are true, but the post is technically credible enough to take seriously. I cant see this holding out for several more hours, with people wanting to use it.
Attached image

commit 9f92224

SR
Stephen Rees-Carter
Interesting. I guess a bunch of folks are pointing their agents at the source trying to find something. It'll be interesting if some of these PoCs are different undiscovered issues.