php

Docker says its PHP Official Images and Hardened Images were updated after CVE-2026-109618 and CVE-2026-109619; the DHI refresh landed within 24 hours of the upstream patches.

PHP's security release names the two CVSS 9.2 flaws as CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state), fixed in four branches.

The PHP security team says a release due October 21 at 14:00 UTC fixes two critical vulnerabilities, both CVSS v4.0 9.2, and urges users to prepare to upgrade.

Socket found malicious code in dev branches of a 700,000-download Laravel Nova package on Packagist, tying the compromise to its ongoing PolinRider campaign.

PHP 8.6.0 Beta 3 landed with a native clamp() function, a SortDirection enum, and a trim() whitespace fix, as the release heads toward a November 19 GA.

After a six-month community process and unanimous vote, the PHP Group has retired the PHP License 3.01 and Zend Engine License in favor of the widely recognized BSD 3-Clause.

Attackers rewrote Git tags across four Laravel localization packages to point to malicious forks, poisoning hundreds of versions and deploying a credential stealer targeting cloud keys, SSH, and crypto wallets.