@Mark Nowiasz Thanks, that's a likely stopgap measure for one of the problems, the other is not so easily mitigated. It's still advisable to upgrade a...

Heads up: Upcoming Critical PHP Security Release

2026-10-21 00:47:42

adminsforum@hubzilla.org

Harald Eilertsen wrote the following post Wed, 21 Oct 2026 00:47:41 -0700

Heads up: Upcoming Critical PHP Security Release

A couple of critical security patches will be released by the PHP team today at 14:00 UTC. Evreryone running any PHP applications (such as Hubzilla) should prepare to upgrade as soon as possible.

While details of the patches are not yet public they do allow remote code execution, and are expected to be exploited pretty much immediately upon release.

Original announcement: https://www.php.net/archive/2026.php#2026-10-20-1

More details: https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/

Be aware that your home routers/wifi access points etc are likely to be running possibly outdated PHP versions as well!

#security #php #admin #advisory

2026-10-21 01:48:38

Mark Nowiasz

buckaroo@hub.netzgemeinde.eu

@Hubzilla Support Forum Apparently there is a workaround for this: https://jackalsyn.com/posts/php-up-2026.html

So
session.upload_progress.enabled = Off
can/should be set until the patches/upgrades are ready

2026-10-21 02:23:58

Harald Eilertsen

harald@hub.volse.no

@Mark Nowiasz Thanks, that's a likely stopgap measure for one of the problems, the other is not so easily mitigated. It's still advisable to upgrade as soon as the patch is dropped.