First screen, captured 4 days ago.

Today's PHP security release, and how we're strengthening security

What HN thinks

A day of sandbags, chocolate biscuits, and a dancing anime girl who broke an embargo.

Chainguard broke embargo irresponsibly
Many see Chainguard publishing fixed images six hours early as self-serving and trust-breaking, with some vowing never to do business with them; a minority argue the leak had already started the clock.
Calif's video caused the chaos
Commenters blame Calif's early, flippant anime PoC video for triggering panic, speculation and independent exploit hunting.
HN as crisis coordination hub
Admins credit the thread for surfacing mitigations like blocking multipart POSTs in nginx, while debating whether PHP should have communicated more during the leak.

Consensus: Most agree the coordinated disclosure fell apart because of leaks by participating firms, and that the PHP team is a small, under-resourced group in a tough spot; whether embargoes still make sense is hotly disputed.

Recommended in the comments

nginx (tool): Used as a proxy to block multipart POSTs as a temporary mitigation before patching.
SiteGround (service): It auto-applied the PHP patch about an hour after release.

Summarised by Claude from the comment thread 3 days ago.

Points: 761
Comments: 394
Best rank: #1
Posted: 2026-10-21 by ejohnso49
Category: Security

php cve remote-code-execution vulnerability-disclosure php-foundation security-audit open-source-funding

All captures:

Full page

Captured 4 days ago. Click for the whole screenshot.

Looks similar

Screenshot of thephp.foundation: PHP Core Security Audit Results

PHP Core Security Audit Results (thephp.foundation)

109 points by moebrowne 1 year ago | 40 comments

Screenshot of thephp.foundation: Welcoming Elizabeth Barron as the New Executive Director of the PHP Foundation

Welcoming Elizabeth Barron as the New Executive Director of the PHP Foundation (thephp.foundation)

37 points by ulrischa 7 months ago | 19 comments

PHP 8.2.35 (github.com)

1036 points by tuyuri 5 days ago | 562 comments

GitHub release page for PHP 8.2.35, a security release fixing two critical unauthenticated remote code execution vulnerabilities; PHP 8.2 reaches end of life December 2026.

php security-release remote-code-execution cve

Screenshot of thephp.foundation: PHP 8.5 adds pipe operator

PHP 8.5 adds pipe operator (thephp.foundation)

403 points by lemper 1 year ago | 253 comments

PHP Foundation blog post by Larry Garfield explaining the pipe operator (|>) coming in PHP 8.5 and how it passes values to callables.

php php-8-5 pipe-operator language-features

Screenshot of github.blog: How GitHub gave every repository a durable owner

How GitHub gave every repository a durable owner (github.blog)

76 points by ascertain 3 months ago | 25 comments

Screenshot of wiz.io: PHP2Shell: AI uncovers critical RCE in PHP

PHP2Shell: AI uncovers critical RCE in PHP (wiz.io)

398 points by danlark1 5 days ago | 184 comments

Wiz Research blog post detailing PHP2Shell, critical memory-safety and pre-auth RCE vulnerabilities in the core PHP engine found with help of frontier AI models.

php remote-code-execution php2shell wiz-research