Posted by tuyuri 10 hours ago
I thought the real lesson was "assume your web server is compromised if you use php, and try to make sure php doesn't touch anything too critical"
At that point I would not need a backend.
The description of the vurnurability "Several multipart parsing problems" makes it sound like it is?
blog that was helpful to me: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-20...
But yeah, with AI agents, I don't really understand the purpose anymore. Legacy WordPress or laravel sites?
Websites depending on an older framework like Zend Framework or libraries like Doctrine 1 do not have a clear upgrade path and are stuck at php5 or have to basically start from scratch. php5 to the latest php8 is just a jump too big.
5.6.40-104+0~20261021.134+debian12~1.gbp7401dd
7.4.33-31+0~20261021.121+debian12~1.gbpe9c428
Now are available in the php-src github
It says pecl.php.net recovered but downloading source for extensions ends up with 504 most of the time.