Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá

Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page vn/news/qdnd/phap-luat-tin-tuc-hai-lo-hong-nghiem-trong-trong-php-da-co-b, snapshot 20261024T083755Z. Copied byte for byte; every file's sha256 is in captures/20261024T083755Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

People's Army Newspaper (Vietnamese), citing Vietnam's Cybersecurity Department and the National Cybersecurity Association: the two CVEs were patched on 21 October and both score 9.2 on CVSS 4.0; Wiz and other teams found them with AI tools and passed the information to the PHP team before disclosure. It says exploitation requires specially crafted requests and exact control of memory state, that a suitably configured WAF can limit some unusual requests but is no substitute for patching, and that some hosting and cloud providers have patched and added WAF rules. For ordinary internet users it says the flaws sit on the servers, not on personal devices or browsers, so there is no need to stop browsing or shopping online, while basic security habits still apply.

> Vì vậy, người dùng internet thông thường không cần ngừng truy cập website, tìm kiếm thông tin, mua sắm hoặc thực hiện các giao dịch trực tuyến chỉ vì thông tin về hai lỗ hổng này được công bố.

_Curator's translation:_ "Therefore, ordinary internet users do not need to stop visiting websites, searching for information, shopping or making online transactions just because information about these two vulnerabilities has been published."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Hai lỗ hổng nghiêm trọng trong PHP đã có bản vá". Selected mechanically, not read by a person.

Capture notes

Language vi. Nothing in the page addresses an AI or hides text from a reader.