PHP-Apocalypse - Aftermath
Afterthoughts about CVE-2026-109618 and CVE-2026-109619
So yeah. That wasn't exactly fun, was it? Let's take inventory:
I hope you're all patched up fully? DNF Updates are all installed and you have the new and fixed PHP PKGs installed?
The current state of things is: We've made BlueOnyx (relatively) secure again in a real hurry. The preventive patch we published ahead of the exact details of the PHP CVEs was half-right and covered the first CVE.
The second CVE? Not so much. But as soon as the official patches came out, we started cranking out fixed PHP RPMs and PKGs. With those installed, you're in good enough shape to weather this particular storm.
As we also suspected very early on, vulnerabilities of this type often have ancillary and related issues that the initial (official) patches don't cover yet-and that only become known in the days ahead when people start digging further into the code. That is now happening.
One example is the research and mitigation notes collected here:
Among other things it discusses a confirmed regression in the new PHP 8.4.27 and 8.5.12 releases (a SimpleXML garbage-collection double-free that can crash processes under certain conditions-php/php-src#24488). A fix for that has already been merged upstream. The repository is also tracking other post-patch research. At this point those reports appear to be distinct from the two CVEs and typically require specific configurations or application behavior rather than representing a general bypass of the official fixes.
We're keeping our ears to the ground and will continue to monitor the situation. Further patches and fixes will be forthcoming when required or advisable.