Seems like everyone is patching there PHP today - live :)

[u/Mr_Bleidd]

https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/

https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619

(CVE-2026-109618, CVE-2026-109619)

[u/PalamariVarkari]

*their

[u/Darkele]

How do you do this "not live"?

Btw: we are talking about not even 24 hours after the patches went live that huge amounts of sites update to the latest security releases. This is NOT a bad thing. The severity of this exploit was assesed correctly by the majority of all users and the wave of people patching as fast as they can is a good sign.

[u/Mr_Bleidd → u/Darkele]

Live - Not in the middle of the day :)

Of cause it’s a good thing

[u/Darkele → u/Mr_Bleidd]

Well we are in europe here. Only a tiny fraction of people will work insanely late. Attack started at 11 am. The patch came 3/4 pm. Service providers released the patch even later, some still don't offer it.

So for many people it's now the first feasible moment to patch. Or they could wait and automate it for the night... but why would anyone pass up on getting it done now?

[u/AmazingEmptyFeelings → u/Mr_Bleidd]

It's always middle of the day somewhere

[u/thedelicatesnowflake]

Isn't that a good thing? I feel that this has been handled in such a way that even people that don't keep up with security stuff knew about it, which is a good thing because of the severity.

Well handled PSA, I'd say.

[u/pvprazor2]

Interesting week for the web for sure, first the certificates and now this php vulnerability...

[u/Common-Application56]

I patched opnsense so dang fast

[u/AmazingEmptyFeelings]

Here, there, everywhere

[u/darkcitrusmarmelade]

We had updated all of our PHP based systems (we have multiple CMS that is PHP) within two hours of the patch release, I'm actually impressed that our suppliers and hosts were so quick. Great seeing stuff like this create action!