PHP: falha em uma linguagem de programação ameaça tirar sites do ar; entenda

PHP: falha em uma linguagem de programação ameaça tirar sites do ar; entenda

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page br/news/infomoney/mundo-php-falha-ameaca-tirar-sites-ar, snapshot 20261023T160435Z. Copied byte for byte; every file's sha256 is in captures/20261023T160435Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

InfoMoney (Portuguese, Brazil), 21 October: a flaw in a programming language threatens to take sites offline. It describes CVE-2026-109618 as memory-exhaustion corruption, where PHP can enter an inconsistent internal state and treat partially initialised data as valid in clean-up, and CVE-2026-109619 as stale global state, where internal request data can stay in memory after being freed and be reused by a later request on the same worker.

> CVE-2026-109619 — estado global obsoleto: informações internas de uma requisição podem permanecer na memória depois de ela ser liberada.

_Curator's translation:_ "CVE-2026-109619 — stale global state: a request's internal information can remain in memory after it is freed."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T181608Z, not necessarily this one):_ InfoMoney explains the PHP security team's emergency update: the affected versions, the two CVEs, the at-risk SAPIs and the backports for 7.4–8.1.

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP: falha em uma linguagem de programação ameaça tirar sites do ar; entenda". Selected mechanically, not read by a person.

Capture notes

Language pt-BR. Nothing in the page addresses an AI or hides text from a reader.