Temporarily Unavailable
arstechnica.com

The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.

It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)

Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5

    • foggy@lemmy.worldEnglish
      2·
      2 hours ago

      I can tell you that every docker container we had running was vulnerable, and none had new versions as of around noon today.

      The manual fix is relatively easy, just change a few configs.