First screen, captured 5 days ago.

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

What HN thinks

Half the internet unplugged itself while the other half argued about embargo etiquette and whether Rust would have saved us.

Shut it down until patched
With PoCs circulating and no reliable mitigation, many argued taking PHP sites offline was the only safe choice, as governments and big Japanese and Dutch services did.
Embargo backfired badly
Selective early access leaked, leaving non-insiders exposed with public exploits but no patch; LLMs make even vague hints enough to find bugs, so delays no longer help.
Coordinated disclosure still matters
Others defended the PHP team's timeline and criticised Chainguard for shipping patched images early, saying breaking embargo undermines trust and aids diffing.

Consensus: Most agree this is severe and widespread, and that interim mitigations like blocking multipart requests and disabling upload progress are at best partial; patch immediately now that releases are out.

Recommended in the comments

Chainguard Images ↗ (service): It shipped patched PHP 8.2-8.5 images early and free, though some called that irresponsible.
deb.sury.org ↗ (service): Suggested for getting fixes on older PHP versions on Debian.
Ubuntu Pro (service): Free for up to five machines and provides backported fixes for old PHP.
Publii (tool): Suggested as a WordPress replacement for simple sites that removes server-side attack surface.
SELinux ↗ (tool): Proposed to limit what a compromised web process can do.