Source · code · primary · captured

Release PHP 8.5.12

php/php-src on GitHub (release by adoy) · https://github.com/php/php-src/releases/tag/php-8.5.12 · published 2026-10-21T14:06:46Z · added by collector-primary · slug github-php-src-tag-php-8.5.12

GitHub release published 2026-10-21T14:06:46Z by adoy; tag object 2026-10-21 13:35:38 UTC; tagged commit dated 2026-10-19T17:04:37Z.

The flaws were disclosed on 22 October 2026The fixes were released at 14:00 UTC on 21 OctoberThe fix was authored on 18 October at 15:26 UTC and entere…2026-10-19 14:00 UTC: Release commits for 8.5.12, 8.4.27, …2026-10-21 14:06:46 UTC: GitHub release php-8.5.12 is publ…php-src

What it says, as the collector read it

GitHub release php-8.5.12: notes

  • "adoy released this", relative-time 2026-10-21T14:06:46Z (about 7 minutes after the planned 14:00 UTC). Tag 2026-10-21 13:35:38 UTC; the tagged commit is from 2026-10-19T17:04:37Z (prepared under embargo).
  • Body repeats php.net: "This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution."

Claims that cite it

ClaimWho says itStatusPrimarySources
The flaws were disclosed on 22 October 2026
Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z.
BBC framing (UK morning coverage)contradicted2/3BBC News php.net php-src
The fixes were released at 14:00 UTC on 21 October
CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times.
php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)disputed7/8oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net
The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 UTC on 21 October, with merges into 8.3, 8.4 and 8.5 between 14:12 and 14:30 UTC
Counted from the repository, not from a page. Five authors; 389 files; 10,689 insertions.
php/php-src commit 3584a98bd, read from a cloneconfirmed2/2php/php-src , read from a clone php-src

Events that cite it

WhenEventTime is
2026-10-19 14:00 UTCRelease commits for 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are made under embargo (14:00 to 17:04 UTC).stated
2026-10-21 14:06:46 UTCGitHub release php-8.5.12 is published by adoy.stated

The bytes

capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/releases/tag/php-8.5.12
  • headers.json 5c5686f2496a1b93d144afdd699626ee85dc4af2813a242dbf615446ddb664eb 5,448 bytes
  • page.html 67ce23eedb690c74470175cf0a56c7a573cbd02ec5f27120c3ced5d05fa5eb3b 207,502 bytes
  • provenance.json 8e480c6bdb33a1d5e82ddf99493ac5149329b2ab40d2fe95c088ba4b9672832a 990 bytes
  • rendered.html 330630ed887249f612aa5637d43d010f74ecc0970060b8bed32da7957a2521aa 214,534 bytes
  • screenshot.png ca5cc2bad8c65a0a5325554ef804f2b83d3fc7a4b7e9c2750dfd7047e564208c 123,213 bytes
  • text.txt 3fa0b4ca147ee06698f340ee959bf381aee7c0fda597bd687ff1f128f4978799 1,184 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →