First screen, captured 4 days ago.

PHP 8.2.35

What HN thinks

A CVSS 10 PHP RCE, a leaked embargo, a slick AI-branded microsite, and everyone refreshing Docker Hub at once.

Disclosure was botched for PR
Many felt the coordinated disclosure leaked early and looked like an AI marketing stunt, leaving everyone outside the inner circle scrambling while polished blog posts went up.
Blame PHP's process, not reporters
Others pointed out the reporters disclosed promptly and the PHP team took a month to acknowledge and another to patch. They argued that releasing any fix early effectively publishes the exploit, especially now that AI can diff patches quickly.
Downstream packaging was a mess
Commenters traded reports of slow Docker official images, misleading rebuilt images still on old versions, and lagging hosts like WP Engine and Cloudways. Debian and Ondřej Surý's repos got praise for being fast.

Consensus: Most agree the rollout was chaotic and the leaked embargo hurt admins, though they disagree on who is to blame. There is broad appreciation for volunteer packagers like Ondřej Surý.

Recommended in the comments

Fil-C (tool): Suggested as a way to block memory-safety RCEs in PHP builds on servers with spare CPU.
FrankenPHP (tool): Its static build shipped the patched PHP quickly while the Docker images lagged.
Debian (product): It patched quickly, so commenters suggested building images from Debian base packages instead of the Docker PHP images.
Ondřej Surý PHP repository ↗ (service): It had fixes out quickly, including backports to old PHP branches, and commenters urged people to sponsor the maintainer.
Remi's RPM repository ↗ (service): Mentioned as the RHEL-side counterpart worth supporting, with updates pushed promptly.

Summarised by Claude from the comment thread 3 days ago.

Points: 1036
Comments: 562
Best rank: #1
Posted: 2026-10-21 by tuyuri
Category: Security

php security-release remote-code-execution cve php-8-2 github-releases

All captures:

Full page

Captured 4 days ago. Click for the whole screenshot.

Looks similar

Screenshot of github.com: PyTorch-native TPU back end for vLLM

PyTorch-native TPU back end for vLLM (github.com)

4 points by zniturah 6 days ago | 0 comments

GitHub repository for vllm-torchtpu, a PyTorch-native TPU backend for the vLLM LLM inference engine.

vllm tpu pytorch llm-inference

OpenSSL 4.1.0 (github.com)

165 points by petecooper 3 days ago | 55 comments

GitHub release page for OpenSSL 4.1.0, a feature release adding DTLS 1.3, GREASE support, ML-DSA/ML-KEM optimizations, and dropping legacy Windows targets.

openssl dtls tls cryptography

Screenshot of github.com: Show HN: Making a smart TV dumb and then smart

Show HN: Making a smart TV dumb and then smart (github.com)

69 points by animalhot 3 days ago | 38 comments

GitHub repo for r2d2-tv, a local home screen, private remote browser, and push-to-talk voice assistant that replaces vendor software on rooted LG webOS TVs.

webos smart-tv lg voice-assistant

Screenshot of github.com: VMMouse for NT 3.x: QEMU/VMware mouse integration driver

VMMouse for NT 3.x: QEMU/VMware mouse integration driver (github.com)

40 points by kiyouta 7 days ago | 8 comments

GitHub repository for an MIT-licensed QEMU/VMware mouse integration driver for Windows NT 3.x, written in C with Docker-based build and ISO installer.

windows-nt device-drivers qemu vmware

Screenshot of github.com: Hedra is a 3D open world game I wrote from scratch while in highschool

Hedra is a 3D open world game I wrote from scratch while in highschool (github.com)

219 points by maxilevi 3 days ago | 41 comments

GitHub repository for Project Hedra, a low-poly procedurally generated 3D open-world RPG and custom C#/OpenGL engine written by its author starting in high school.

game-development game-engine csharp opengl

Screenshot of github.com: Show HN: Sumi.css – CSS Framework

Show HN: Sumi.css – CSS Framework (github.com)

58 points by bepero 5 days ago | 13 comments

GitHub repository for Sumi.css, a minimalist classless-first CSS framework (6.7 KB gzipped) with dark mode, theming via custom properties, and no build step.

css css-framework classless-css css-grid