CATEGORY · Security
Security
3 POSTS
NO PATCH COMING · P2
Put Your Unpatchable PHP in a Box
Helping a client whose jump to PHP 8.2+ was a months-long climb, I kept circling a stopgap that sounds unhinged: wrap the legacy interpreter at the web-server …
NO PATCH COMING · P1Still on PHP 7.4 and Can't Upgrade? Mitigating the October 2026 RCEs Today
Two critical PHP RCEs shipped in October 2026. If you're on PHP 7.4 or 5.4 there is no patch coming, and the diff confirms you're affected. Here's what actually …
SECURITYThe October 2026 PHP Critical Release: What It Is, and What It Means If You're Still on PHP 7
PHP shipped fixes for two critical, unauthenticated RCEs on October 21, 2026 — CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. If you're on 8.2+, update …