|
PHP |
News |
|
|
Oct 20 - Oct 27, 2026
|
|
Thanks to our partner
|
|
|
|
In this issue
|
-
The php2shell Scare Showed How Much Runs on PHP
-
PHP Windows Builds Patch Brotli CVE-2026-111497
-
PHP Warns of Another Session Upload Progress RCE Path
-
Chainguard Broke the php2shell Embargo
|
|
3 more stories · 10 community links · 2 RFC votes open · 2 RFCs decided · 3 new RFCs · 4 upcoming events
|
|
|
Community
|
|
|
The php2shell scare pulled PHP onto front pages worldwide, from Japan's prime minister to the NSA, and showed how much of the internet quietly runs on it.
|
|
|
More this week
|
|
PHP Core
Rebuilt PHP Windows binaries 8.2.35-1 to 8.5.12-1 ship Brotli 1.2.1 to fix CVE-2026-111497. The PHP version doesn't change, so che...
|
|
|
|
|
|
PHP Core
The PHP security team says to set session.upload_progress.enabled=0 until the next bugfix release to block a rare RCE path, CVE-20...
|
|
|
|
|
|
PHP Core
Chainguard CEO Dan Lorenc says exploit reports justified shipping PHP RCE fixes before the embargo lifted. The reports don't hold...
|
|
|
|
|
|
PHP Core
The PHP Foundation says the OOM bug behind today's PHP RCE fix was first spotted in 2024, the fix stalled for months, and a leak m...
|
|
|
|
|
|
PHP Core
OpenAI says its Patch the Planet program coordinated the php2shell disclosure after Calif used GPT-5.6 Sol to find a critical PHP...
|
|
|
|
|
|
PHP Core
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two CVSS 9.2 bugs that allow unauthenticated remote code execution. Who's at risk and h...
|
|
|
|
|
RFC Watch
|
|
Voting now
24 yes, 1 no. Voting closes November 1.
|
|
|
|
Voting now
2 yes, 11 no. Voting closes November 4.
|
|
|
|
Implemented
Speeds up asymmetric visibility by resolving read and write access separately instead of re-checking on every write.
|
|
|
|
Implemented
25 yes, 0 no.
|
|
|
|
New proposal
Adds array_partition(), which splits an array into the elements a callback accepts and the ones it rejects, keeping keys, in one pass.
|
|
|
|
New proposal
Adds a Scope class that marks which request or job code belongs to, carried into fibers and generators, for servers that handle many requests at once.
|
|
|
|
New proposal
Adds a using expression that wraps a block in a generator, so setup and cleanup like closing files or committing transactions happen automatically.
|
|
|
|
Follow every RFC on the tracker →
|
|
|
|
|
|
PHP News
Independent coverage of the PHP language, its ecosystem and the people building it.
Written by PHP developers, for PHP developers
|
|