PHP 发布安全更新修复两个 RCE 漏洞，并说明披露泄露经过
原标题：Today's PHP Security Release, and How We're Strengthening PHP Security
AI 摘要
PHP 项目于 2026 年 10 月 21 日发布覆盖整个 PHP 8.x 系列的安全更新，修复两个可导致远程代码执行的漏洞。由于协调披露流程中出现泄露，CVE 编号提前在论坛和社交媒体流传，并伴随错误的发布时间和 CVSS 评分；PHP 项目因此提前发布公告并提前上线补丁。泄露还导致安全公司 Calif 误发概念验证视频，加速了 PoC 的传播。漏洞最初由 Wiz Research 于 8 月发现并报告，确认可未授权攻击 Drupal 和 WordPress。
正文节选
21st October 2026 - Link Blog Today's PHP Security Release, and How We're Strengthening PHP Security (via) If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since last night, thanks to a leak in the coordinated disclosure process. This post from the PHP Foundation explain what went so wrong: On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs bega