So the worst today was legacy running on Amazon Linux with PHP. They released a fix minutes before the PHP release. The fix was the incomplete php.ini mitigations.
They did not follow up with a new version yet. Crazily misleading.
Commit
aff3a9d
The issue is a real shitshow: https://github.com/amazonlinux/amazon-linux-2023/issues/1148
GitHub[Package Update Request] - PHP CVE 2026-109618 and CVE-2026-109619 · Issue #1148 · amazonlinux/amazon-linux-2023PHP is releasing a CRITICAL security update today (21.10.2026): https://www.php.net/archive/2026.php#2026-10-20-1 This update will fix two critical CVE: CVE 2026-109618 CVE-2026-109619 Both rated C...
commit aff3a9d