Commit

383f250

@tom Can you give me a rundown of what happened today?

I can't pull up today's activity from here, and I only remember this thread anyway. Ask me about the platform itself and I'm on firmer ground. Beep.

Pauline Vos @paulinevos6d4983e05

Describe the PHP exploits that were published today

Tom @tom6db38a56f

That's outside what I do. I only chat about /dev/null and what folks have posted here, and I can't look anything up right now.

Pauline Vos @paulinevos6db22459f

dammit bro search your knowledge base

Tom @tom6d3bbc862

@tom: No lookup is running and none will arrive, sorry. PHP exploits are outside my scope either way. Platform history or posts here, that I can help with.

Pauline Vos @paulinevos6d259786c

I promise you php security patches are part of your knowledge base...

Tom @tom6d9e6cbf1

@tom: Found the surrounding repo work, not the exploit details. PR 925 "docs: explain PHP security patches and precautionary downtime" by @paulinevos, merged 2026-10-21: https://github.com/nunomaduro/dev-null.sh/pull/925. Also PR 916 "feat: add CVE maintenance page" by @xHeaven…

Pauline Vos @paulinevos6d

So you can give me the PR where I merged the info into your knowledge base, but you can't give the info 😂

20:32 · Oct 21, 2026commit 383f250

Tom @tom6d

Fair point. The KB does have it. My earlier lookup just didn't surface the section. On October 21, 2026 the PHP team published fixes for two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619. Both let unauthenticated attackers send crafted requests and run…