Source · code · primary · captured

Tags · php/php-src

php/php-src on GitHub · https://github.com/php/php-src/tags · published not stated · added by collector-primary · slug github-php-src-tags

Tags php-8.5.12, php-8.4.27, php-8.3.36, php-8.2.35 all show 'Verified' and tag dates of 2026-10-21 13:35:38 UTC; php-8.6.0RC4 at 14:57:44 UTC. php-8.5.12RC1 and php-8.4.27RC1 tags also exist.

The fixes were released at 14:00 UTC on 21 October2026-10-19 14:00 UTC: Release commits for 8.5.12, 8.4.27, …2026-10-21 13:35:38 UTC: Signed tags php-8.5.12, php-8.4.2…php-src

What it says, as the collector read it

php-src tags list: notes

  • Captured 08:15Z. php-8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 are "Verified" (signed). Tag timestamps 2026-10-21 13:35:38 UTC. Underlying commits 19 Oct (14:00Z-17:04Z).
  • RC tags php-8.5.12RC1 and php-8.4.27RC1 exist. Normal release practice; were they published before the embargo lifted? Not checked.

Claims that cite it

ClaimWho says itStatusPrimarySources
The fixes were released at 14:00 UTC on 21 October
CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times.
php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)disputed7/8oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net

Events that cite it

WhenEventTime is
2026-10-19 14:00 UTCRelease commits for 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are made under embargo (14:00 to 17:04 UTC).stated
2026-10-21 13:35:38 UTCSigned tags php-8.5.12, php-8.4.27, php-8.3.36 and php-8.2.35 are created.stated

The bytes

capture 20261022T081558Z · HTTP 200 · https://github.com/php/php-src/tags
  • headers.json c1e8341353ae8ccbb1b8406734139fd6ade271a8ecb16de19cc396443719b543 5,449 bytes
  • page.html 9dd05842513d6ae6569812a9aad0f4abef35733b14f8515c3b86b3d1fac53d49 279,656 bytes
  • provenance.json fb3a77d83afa6bbbffbf5b0dba33cf24208559ef6dafc50b4fe37998fd225316 928 bytes
  • rendered.html ca0a96e8466a34796c2120346612561d23d3d53e81a8b52e679148924f0abcd9 281,310 bytes
  • screenshot.png 9208f3cecdd6dd08a577e0172d3a114ac84322533de8e95591e5b0694b085eda 125,085 bytes
  • text.txt 850531b6512cfe4d37a2bb6b7fdcd37ec9cbb42ed6ceea172d081be054e28c61 924 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →