Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · technical · unverified
The 8.5.12 fix may be incomplete, or there is a third, different bug
Per a Matrix channel, Canonical asked PHP and 'was told that it's unrelated and not a real issue'. Second-hand. Nothing from PHP on the list at capture.
Fact-check
A1 Weak signal●○○○○○ opinion disputed · Opinion · verdict: not shown
The only carrier is a relay on oss-security of unnamed Fediverse posts ('While not yet fully confirmed'), not captured themselves; PHP is reported second-hand to have called it unrelated. Second-hand and unconfirmed is A1, and nothing shows the fix is incomplete; 'unverified' fits.
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| openwall-oss-security-109619-thread | partial | While not yet fully confirmed, the Fediverse is reporting that the fix to at least PHP 8.5.12 may be incomplete: | 6a76141ae5a06584 |
| openwall-oss-security-109619-thread | partial | ok thinking more about this, there's no way this is the same vuln, this is > another one. | 059317aa4a1f458e |
| openwall-oss-security-109619-thread | partial | was told that it's "unrelated and not a real issue". | 39555f34a419becc |
Open tickets: Contradiction-11, Evidence-5, Evidence-7, Evidence-8, Finding-125, Finding-72, Gap-2.
Graded in Run-1, resting on captures up to 2026-10-22 08:14 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21 15:24 UTCoss-security publishes Re: CVE-2026-109619 thread (21/16, 21/17, 21/23, 22/2)
- 2026-10-22Enters this site as unverified in v0.1.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · unverified
The 8.5.12 fix may be incomplete, or there is a third, different bug Who says it: Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez Status: unverified Topic: technical Sources: openwall-oss-security-109619-thread