[LUG]Re: PHP Vulnerabilities

To: list@xxxxxxxxxxxxx

Subject: [LUG]Re: PHP Vulnerabilities

From: Adam Ainsworth <adam.ainsworth@xxxxxxxxx>

Date: Wed, 21 Oct 2026 09:30:56 +0100

Delivered-to: dclug@xxxxxxxxxxxxxxxxxxxxx

Dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=dcglug.org.uk; s=1792141562; h=Content-Type:List-Unsubscribe:List-Subscribe :List-Post:List-Owner:List-Help:List-Id:Subject:Reply-To:To:In-Reply-To: References:Message-Id:Date:Mime-Version:From:Sender:Cc: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Archive; bh=4QCs+JlAqs5AZ1EDhQmqEizP+O7UWjdp454co+HEJZU=; b=2/ldDtQVJ1y7zzBaVd+vl7qmte tovBPDjro8fiqo2LJK2bO9noCLCDfcgqO078/L2umZtW27fGHEJRqjEdqAnkafEC1D6SGdASQPgG5 faeawMvZ03rlut7xUF3SCEuzE+ubfjDWQ5FRzHjFGhawjBNgYfyMbsPHaAmnhUdu/uqE=;

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792571458; x=1793176258; darn=dcglug.org.uk; h=to:in-reply-to:cc:references:message-id:date:subject:mime-version :from:content-transfer-encoding:content-type:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AQAEcktJU/G8AXROlEcjIfvmE/PBGOya/PoazK20HMM=; b=j04pxDrHTCGEJZLot9tVjnxRIduIGdZ++AEMhAeMgcLTEffB37u2ldWthg+CWBTSqA 5Cp7bsy2nNGbnunMP4nXTd6UKkscYZhqNh8N9OQcAN45vWSDxvKHNkz9GHxPpiYkuC7c cqvwvrVTJBhe+fIAF9YGRpwu71NFmOeVDobgDRfpsfwTgzOS2NL8OnFtTXPKQQKyoWMO wNXJIz3FCzutF3EoQYzHyFedZ1cME3v6ZwRZmmkwKOgNcIxtLm9+sMyIa++F9ijusjCi DaRyLvUpZsDcifuq4wEkEXxzP7O1FDQqVRYRV3NWJIjKpOCyDZIuVMqQilVnxfa53Ar1 cRPQ==

If you’re behind Cloudflare, you should be safe as they are blocking malicious payloads that can trigger the vulnerabilities.

========

On 21 Oct 2026, at 08:37, zleap via list <list@xxxxxxxxxxxxx> wrote:

Pixelfed have put their sites in to maintenance mode until there is a fix, I have done the same for my site, and the tinkerers and dcglug subdomains

Paul

On 2026-10-21 02:26, Simon Waters wrote:

Not a huge fan of pre-announcing these things as it always makes people
very nervous, only sometimes justifiably. But heads up for announcement
14:)) UTC

https://cert.europa.eu/publications/security-advisories/2026-018/

--

Paul Sutton
https://zleap.net/

--
The Mailing List for the Devon & Cornwall LUG
FAQ: https://www.dcglug.org.uk/faq/

-- The Mailing List for the Devon & Cornwall LUG FAQ: https://www.dcglug.org.uk/faq/

References:

[LUG]Re: PHP Vulnerabilities
- From: zleap via list