各位 PHPer 们，准备好了吗？今晚 22:00 不见不散！

[Hypixel]

Upcoming Critical PHP Security Release

20 Oct 2026

The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

来源：https://www.php.net/archive/2026.php#2026-10-20-1

[xLuoBo]

⚠⚠ PHP 核心 RCE （ CVE-2026-109618 / CVE-2026-109619 ，CVSS 9.2 ）

PHP 解释器核心层 未公开细节，mod_php 与 PHP-FPM 两种部署都被打通 → 命令回显（ www-data ），可读库配置、写 WebShell ，站点等于沦陷

PoC：暂无公开 PoC （演示视频「 PHP2Shell 」已流出）

演示覆盖 WordPress 、Drupal 、Joomla 、Laravel 、Symfony 、Magento 、MediaWiki 、phpBB 、WHMCS 等九款 PHP 应用主流框架

🔗FOFA 聚合查询结果命中 75,621,744 条（国内 1,009,808 条）

https://fofa.info/result?qbase64=YXBwPSJXb3JkUHJlc3MiIHx8IGFwcD0iRHJ1cGFsIiB8fCBhcHA9Ikpvb21sYSIgfHwgYXBwPSJMYXJhdmVsIiB8fCBhcHA9Ik1lZGlhV2lraSIgfHwgYXBwPSJNYWdlbnRvIiB8fCBhcHA9InBocEJCIiB8fCBhcHA9IlN5bWZvbnkiIHx8IGFwcD0iV0hNQ1Mi

🔖参考： https://www.php.net/archive/2026.php#2026-10-20-1

📢 具体受影响版本需等正式发布才公布（公开泄露信息称 PHP 5 及之后版本均可能受影响，该范围尚未获得官方确认），官方公告写的是计划今晚 22:00 出补丁（也可能提前）

[zuokanyunqishi]

php 一死,有事烧纸...

[skyrim61]

累了, 毁灭吧

[GoogleQi]

小修可以修，我们有 5.6 7.0 8.0 大修不管了 🤣

[lujiaosama]

怎么办，炸了再说。

[512357301]

怎么了，出什么大 bug 了？
7 年前学过，后来换 python 了，没怎么关注 PHP 了。