Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safe

Fact-check

A6 Established●●●●●● · Advice · verdict: holds

php.net's advisory carries the claim almost word for word, and both GHSAs and the oss-security post say updating is the only complete/reliable mitigation. The party's own records carry the advice.

Graded in Run-1, resting on captures up to 2026-10-22 08:14 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-21php.net publishes Security advisory: Critical remote code execution vulnerabilities, update now
2. 2026-10-21 13:34 UTCPHP publishes RCE via stale global state (CVE-2026-109619)
3. 2026-10-21 14:44 UTCoss-security publishes CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state
4. 2026-10-22 08:09 UTCSaved into the evidence vault: php.net
5. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP
6. 2026-10-22 08:14 UTCSaved into the evidence vault: oss-security
7. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safe
Who says it: php.net; PHP security team
Status: confirmed
Topic: technical
Sources: php-net-advisory, openwall-oss-security-2026-10-21-7, github-ghsa-6wmf-4rv5-p3rp