#phpc

Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 on Wednesday, keep it disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected.

Information advisory on PHP website by the PHP security team: https://www.php.net/archive/2026.php#2026-10-23-1

#php #phpc

If all the governments shutting down their servers for a PHP vulnerability, all the hosting companies and enterprises terrified by the vuln, would give $100k, heck only $50k a year to the PHP Foundation, things could look very differently. Go make your employer sponsor today https://thephp.foundation/sponsor/ #php #phpc @thephpf@phpc.social

In all seriousness, @thephpf@phpc.social and collaborators coordinating the disclosure did an amazing job (even if it was disrupted by some). Really proud of their efforts.

Makes me think: how much worse could this have been for everyone if we didn't have @thephpf@phpc.social funding work like this?

The fact there was a 11k LOC patch, including backports for EOL versions, is awesome. If your company depends on PHP, and you don't already sponsor, please consider: https://thephp.foundation/sponsor/ #php #php2shell #ThePHPF #phpc

Applications for The PHP Foundation contractors for 2027 are now open! We are looking for help in certain areas but we are open to your ideas as well. Application period ends on October 20, 2026. Apply now! https://thephp.foundation/blog/2026/09/30/applications-for-2027-are-open/

#phpc #php

Community events are the lifeblood of the PHP ecosystem and how we build trust in an ever-changing world. We are very happy to announce the launch of the Community Events Coalition SIG to help keep these crucial pieces of our community thriving. Read more: https://thephp.foundation/blog/2026/09/28/kicking-off-the-community-events-coalition-sig/
#php #phpc #opensourceevents