I've spent some deepseek tokens on trying to reproduce this CVE with what is known so far; (Very little beyond effected versions and a hint that her search started because of the current bug, but that it's probably a different one entirely).<p>It found nothing.<p>Take that for what it is.<p>Together with <a href="https://www.openwall.com/lists/oss-security/2026/10/21/23" rel="nofollow">https://www.openwall.com/lists/oss-security/2026/10/21/23</a> you're probably not going to need to stay up for this.
That post shows a real bug but as far as I can tell it's not a critical CVE. It appears to produce the same stack trace as this reported issue <a href="https://github.com/php/php-src/issues/24488" rel="nofollow">https://github.com/php/php-src/issues/24488</a>, which is a confirmed GC regression in 8.5.12 but it is not exploitable (the allocator's shadow protection kills it), and it does not result in RCE.<p>It's a very different shape to the other two CVEs, and a use-after-free doesn't necessarily immediately imply a critical CVE.
From the little info one can see here, it looks like this is a PHP script causing a memory corruption. So you probably need to be able to run PHP code to exploit it.<p>That's... not a particularly unusual issue. PHP has a large codebase, releases with plenty of fixed crashes come out regularly. It becomes critical if there's a remote path to exploitation.<p>I see no indication that this is a "critical" PHP flaw. And the Reply from the person who found it seems to confirm that. ("I keep getting asked about mitigations, here's the mitigation: don't worry about it kitten")
<a href="https://www.openwall.com/lists/oss-security/2026/10/21/23" rel="nofollow">https://www.openwall.com/lists/oss-security/2026/10/21/23</a>
Oh, it's going to be one of <i>those</i> weeks.
There is literally no info on how this is triggered. From the info this could range anywhere from total non issue to zOMG. Given how keyed up everyone is, i lean towards the former.<p>honestly, i would just wait for php announcement and assume its no big deal until then.
Got really triggered... By the font.
[dead]
I mean it the first time [0], PHP is done.<p>[0] <a href="https://news.ycombinator.com/item?id=50181423">https://news.ycombinator.com/item?id=50181423</a>
PHP is having a really bad day today