Failles PHP critiques : versions corrigées à installer

Failles PHP critiques : versions corrigées à installer

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page fr/news/encause/failles-php-critiques-php2shell-mise-a-jour, snapshot 20261026T071149Z. Copied byte for byte; every file's sha256 is in captures/20261026T071149Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

En cause (French), 25 October, by Arnaud Virel. The capture holds the lead, the table of contents and the first section only (the rest sits behind a 'read more'). The lead says two critical PHP flaws allow remote code execution without authentication under some conditions, that the PHP project, CISA and CERT-EU ask for an immediate update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and that CISA had not yet seen successful exploitation at its last update. The contents list a third vulnerability reported on 23 October and a section on no public proof of a successful attack at that hour; that text is not in the capture.

> Le projet PHP, la CISA et le CERT-EU demandent une mise à jour immédiate vers PHP 8.5.12, 8.4.27, 8.3.36 ou 8.2.35.

_Curator's translation:_ "The PHP project, CISA and CERT-EU ask for an immediate update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Failles PHP critiques : versions corrigées à installer". Selected mechanically, not read by a person.

Capture notes

Language fr-FR. Nothing in the page addresses an AI or hides text from a reader.