# Fact: The 8.5.12 fix may be incomplete, or there is a third, different bug

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The 8.5.12 fix may be incomplete, or there is a third, different bug Who says it, its status (unverified), its sources, and its timeline from publication to this site.

Fact · technical · unverified

# The 8.5.12 fix may be incomplete, or there is a third, different bug

**Who says it:** Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez · **Sources:** [oss-security](../../sources/openwall-oss-security-109619-thread/index.html)

Per a Matrix channel, Canonical asked PHP and 'was told that it's unrelated and not a real issue'. Second-hand. Nothing from PHP on the list at capture.

## Fact-check

**A1** Weak signal●○○○○○ opinion disputed · Opinion · verdict: **not shown**

The only carrier is a relay on oss-security of unnamed Fediverse posts ('While not yet fully confirmed'), not captured themselves; PHP is reported second-hand to have called it unrelated. Second-hand and unconfirmed is A1, and nothing shows the fix is incomplete; 'unverified' fits.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [openwall-oss-security-109619-thread](../../sources/openwall-oss-security-109619-thread/index.html) | partial | *While not yet fully confirmed, the Fediverse is reporting that the fix to at least PHP 8.5.12 may be incomplete:* | 6a76141ae5a06584 |
| [openwall-oss-security-109619-thread](../../sources/openwall-oss-security-109619-thread/index.html) | partial | *ok thinking more about this, there's no way this is the same vuln, this is > another one.* | 059317aa4a1f458e |
| [openwall-oss-security-109619-thread](../../sources/openwall-oss-security-109619-thread/index.html) | partial | *was told that it's "unrelated and not a real issue".* | 39555f34a419becc |

Open tickets: [Contradiction-11](../../factcheck/index.html#Contradiction-11), [Evidence-5](../../factcheck/index.html#Evidence-5), [Evidence-7](../../factcheck/index.html#Evidence-7), [Evidence-8](../../factcheck/index.html#Evidence-8), [Finding-125](../../factcheck/index.html#Finding-125), [Finding-72](../../factcheck/index.html#Finding-72), [Gap-2](../../factcheck/index.html#Gap-2).

Graded in Run-1, resting on captures up to 2026-10-22 08:14 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21 15:24 UTCoss-security publishes [Re: CVE-2026-109619 thread (21/16, 21/17, 21/23, 22/2)](../../sources/openwall-oss-security-109619-thread/index.html)
- 2026-10-22Enters this site as unverified in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
CCaseyWebsite ownerSSamSecurity leadDDrewPHP or platform engineerAAshSecurity researcherRRobinCISOAAveryCTOMMorganData protection officerJJamieHead of AppSecLLeeDeveloper
And on [every claim](../../claims/index.html#fix-incomplete).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · unverified
```
The 8.5.12 fix may be incomplete, or there is a third, different bug
Who says it: Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez
Status: unverified
Topic: technical
Sources: openwall-oss-security-109619-thread
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/fix-incomplete/index.html