The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
Synology had a critical system and PHP package update yesterday, could it be related 🤔
No, there is no fix released for this PHP vulnerability
Wouldn’t be surprised if the big guys got first dibs before everyone else
@Guiorgy @shadowtofu That’s not how embargoes work. If “the big guys” release, everybody releases. There have clearly been leaks, but afaik no patches made public yet.
Dibs on the patches? They are not finite.
Commercial patching and the sla’s are huge business. You do know how rhel works right?
Yes. And again, patches aren’t a finite commodity.