[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f2358um1tpx1op":56,"i-tabler:arrow-left":122,"i-tabler:tag":124},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":76,"author":77,"related":80},"php-will-ship-emergency-fixes-for-two-critical-vulnerabilities-tonight","PHP Will Ship Emergency Fixes for Two Critical Vulnerabilities Tonight","The PHP security team will release fixes for two critical vulnerabilities, both rated CVSS v4.0 9.2, on October 21 at 14:00 UTC (10 PM Manila). Affected and fixed versions come with the release. Here is how to get ready now.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fphp-critical-release-oct21.png","2026-10-21T09:06:17.000+08:00",[63,66],{"key":64,"label":65},"advisories","Advisories",{"key":67,"label":68},"security","Security",10,"\u003Cdiv>\n\u003Cp>\u003Cstrong>Update (Oct 22, 11:52 PM PHT):\u003C\u002Fstrong> AlmaLinux, the last major holdout, has published fixed PHP packages for CVE-2026-109618 and CVE-2026-109619. AlmaLinux 10 gets php 8.3.36 (\u003Ca href=\"https:\u002F\u002Ferrata.almalinux.org\u002F10\u002FALSA-2026-87070.html?ref=ghost.jdneer.com\">ALSA-2026:87070\u003C\u002Fa>) and php8.4 8.4.27 (\u003Ca href=\"https:\u002F\u002Ferrata.almalinux.org\u002F10\u002FALSA-2026-87071.html?ref=ghost.jdneer.com\">ALSA-2026:87071\u003C\u002Fa>). AlmaLinux 9 gets fixed php:8.2 and php:8.3 module streams (\u003Ca href=\"https:\u002F\u002Ferrata.almalinux.org\u002F9\u002FALSA-2026-87072.html?ref=ghost.jdneer.com\">ALSA-2026:87072\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Ferrata.almalinux.org\u002F9\u002FALSA-2026-87079.html?ref=ghost.jdneer.com\">ALSA-2026:87079\u003C\u002Fa>). AlmaLinux 8 gets a fixed php:7.4 stream (\u003Ca href=\"https:\u002F\u002Ferrata.almalinux.org\u002F8\u002FALSA-2026-87080.html?ref=ghost.jdneer.com\">ALSA-2026:87080\u003C\u002Fa>); its php:8.2 stream has no advisory yet. On Fedora, 44 is fixed, while the Fedora 43 and 45 updates are still in testing. The bugs are still not in CISA's Known Exploited Vulnerabilities catalog, even though attacks in the wild have been reported since Oct 21. If you run PHP on AlmaLinux, run \u003Ccode>dnf upgrade php*\u003C\u002Fcode> and restart PHP-FPM.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 8:22 PM PHT):\u003C\u002Fstrong> Rocky Linux 8 now has a fixed php:8.2 module stream: \u003Ca href=\"https:\u002F\u002Ferrata.rockylinux.org\u002FRLSA-2026:87073?ref=ghost.jdneer.com\">RLSA-2026:87073\u003C\u002Fa> ships php 8.2.35 and fixes CVE-2026-109618 and CVE-2026-109619. Rocky 8 users on the php:8.2 stream should update now with \u003Ccode>dnf upgrade php\\*\u003C\u002Fcode> and restart PHP-FPM or the web server. Rocky 8 php:7.4 and the Rocky 9 and 10 fixes shipped earlier today. AlmaLinux still has no PHP errata, and the Fedora 43 and 45 updates are still in testing. CISA has not added the CVEs to its Known Exploited Vulnerabilities catalog yet.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 9:45 AM PHT):\u003C\u002Fstrong> TuxCare says all of its fixed PHP packages are now released. That covers its Extended Lifecycle Support builds of older PHP versions (alt-php 5.2 to 8.5), the distributions' own PHP packages on ELS systems such as CentOS 6, 7 and 8, RHEL 7, Oracle Linux 6 and 7, Debian 10 and 11, and Ubuntu 16.04 and 18.04, plus PHP for Windows. On CentOS 7 ELS, for example, the fix is php 5.4.16-48.el7.tuxcare.els21 (\u003Ca href=\"https:\u002F\u002Ferrata.tuxcare.com\u002Fels_os\u002Fcentos7els\u002FCLSA-2026-1792615126.html?ref=ghost.jdneer.com\">CLSA-2026:1792615126\u003C\u002Fa>). CloudLinux has also moved fixed alt-php 5.2 to 8.5 into its regular stable repositories for CloudLinux OS 7, 8 and 9, so the separate ELS repository step is no longer needed (\u003Ca href=\"https:\u002F\u002Fcloudlinux.statuspage.io\u002Fincidents\u002Fzl0vt1yq3dj5?ref=ghost.jdneer.com\">CloudLinux status page\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fcve.tuxcare.com\u002Fels\u002Fcve\u002FCVE-2026-109618?ref=ghost.jdneer.com\">TuxCare CVE tracker\u003C\u002Fa>). Security advisory metadata isn't published yet, so security-only updates such as \u003Ccode>yum --security\u003C\u002Fcode> won't list these packages. Run a regular update and restart PHP-FPM or the web server. AlmaLinux is still the main distribution without fixed PHP packages.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 8:15 AM PHT):\u003C\u002Fstrong> Rocky Linux has published fixed PHP packages for Rocky Linux 8, 9 and 10 that cover both CVE-2026-109618 and CVE-2026-109619. The advisories are RLSA-2026:87070 (php) and RLSA-2026:87071 (php8.4) for Rocky Linux 10, RLSA-2026:87079 (php:8.3), RLSA-2026:87072 (php:8.2) and RLSA-2026:87151 (php) for Rocky Linux 9, and RLSA-2026:87080 (php:7.4) for Rocky Linux 8. Run \u003Ccode>dnf upgrade\u003C\u002Fcode>, then restart PHP-FPM and the web server. Backported packages keep their old version numbers, so check the package changelog for the two CVE IDs (\u003Ca href=\"https:\u002F\u002Ferrata.rockylinux.org\u002FRLSA-2026:87070?ref=ghost.jdneer.com\">Rocky Linux errata\u003C\u002Fa>). AlmaLinux hasn't published PHP errata yet, and the Fedora 43 and 45 updates are still pending.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 6:50 AM PHT):\u003C\u002Fstrong> CloudLinux says fixed alt-php packages for CloudLinux OS 7, 8 and 9 are now available, but only from the separate ELS ALT PHP repository, not the regular CloudLinux repositories. Servers must be registered with CLN, install the \u003Ccode>els-php-release\u003C\u002Fcode> package, then update alt-php and restart Apache, PHP-FPM or LiteSpeed. CloudLinux OS 10 already uses that repository and only needs a regular update. CloudLinux recommends checking each package's changelog for both CVE IDs to confirm the fix (\u003Ca href=\"https:\u002F\u002Fcloudlinux.statuspage.io\u002Fincidents\u002Fzl0vt1yq3dj5?ref=ghost.jdneer.com\">CloudLinux status page\u003C\u002Fa>).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 6:25 AM PHT):\u003C\u002Fstrong> CloudLinux has corrected its earlier package status. The fixed alt-php packages it announced at 19:00 UTC went to the TuxCare ELS alt-php repository, not the CloudLinux repositories, so CloudLinux 7, 8 and 9 servers did not have them yet at that point. CloudLinux 10 installs alt-php from the TuxCare ELS repository, and fixed alt-php 7.4 is confirmed there. Fixed ea-php packages for cPanel EasyApache 4 (ea-php52 through ea-php85) are released, and Imunify360 rulesets 8.84 and 8.85 add blocking rules, including on LiteSpeed (\u003Ca href=\"https:\u002F\u002Fcloudlinux.statuspage.io\u002Fincidents\u002Fzl0vt1yq3dj5?ref=ghost.jdneer.com\">CloudLinux status page\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fblog.cloudlinux.com\u002Fphp-cve-2026-109618-and-cve-2026-109619?ref=ghost.jdneer.com\">CloudLinux blog\u003C\u002Fa>).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 3:50 AM PHT):\u003C\u002Fstrong> TuxCare has started shipping fixes for PHP versions that php.net no longer supports. Its ELS for Runtimes post, updated at 19:42 UTC on October 21, says PHP 7.4 builds are already out on nearly every supported Linux platform, and the other end-of-life branches are still rolling out, with timing varying by branch and platform. The builds install through the usual yum, dnf or apt update and sit alongside other PHP versions under \u003Ccode>\u002Fopt\u002Falt\u002F\u003C\u002Fcode>, so restart every PHP worker after updating (\u003Ca href=\"https:\u002F\u002Ftuxcare.com\u002Fblog\u002Fphp2shell-cve\u002F?ref=ghost.jdneer.com\">TuxCare\u003C\u002Fa>).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 1:00 AM PHT):\u003C\u002Fstrong> Fedora has started shipping. Fedora 44's php-8.5.12-1.fc44 update, which fixes both CVEs, went to stable at 12:43 AM PHT, so Fedora 44 users can update with \u003Ccode>dnf upgrade\u003C\u002Fcode> now (\u003Ca href=\"https:\u002F\u002Fbodhi.fedoraproject.org\u002Fupdates\u002FFEDORA-2026-a9eba4bbc3?ref=ghost.jdneer.com\">FEDORA-2026-a9eba4bbc3\u003C\u002Fa>). The Fedora 43 and 45 updates are still pending. CloudLinux and TuxCare have also released fixed PHP for CentOS 8.4 ELS (php 7.4.6) and Ubuntu 16.04 and 18.04 ELS (php 7.0.33 and 7.2.24) (\u003Ca href=\"https:\u002F\u002Fcloudlinux.statuspage.io\u002Fincidents\u002Fzl0vt1yq3dj5?ref=ghost.jdneer.com\">CloudLinux status page\u003C\u002Fa>). Neither CVE is in CISA's Known Exploited Vulnerabilities catalog so far.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 22, 12:25 AM PHT):\u003C\u002Fstrong> A new public exploit repository, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002F3em0\u002Fphp2shell?ref=ghost.jdneer.com\" rel=\"nofollow noopener\">3em0\u002Fphp2shell\u003C\u002Fa>, claims remote, HTTP-only code execution against PHP 8.4.26 running under Apache prefork with mod_php, with ASLR bypassed and no file written to the target. The code is public but hasn't been independently tested. Canonical has extended its fix to older Ubuntu releases through Ubuntu Pro ESM: php5 on 14.04, php7.0 on 16.04, php7.2 on 18.04 and php7.4 on 20.04 (\u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fsecurity\u002Fnotices\u002FUSN-8948-2?ref=ghost.jdneer.com\">USN-8948-2\u003C\u002Fa>). The PHP project has published GitHub advisories for both bugs (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-w8hw-w9fx-j79w?ref=ghost.jdneer.com\">GHSA-w8hw-w9fx-j79w\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-6wmf-4rv5-p3rp?ref=ghost.jdneer.com\">GHSA-6wmf-4rv5-p3rp\u003C\u002Fa>).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 21, 11:25 PM PHT):\u003C\u002Fstrong> Both vulnerabilities are now being exploited in the wild. watchTowr's FAQ lists CVE-2026-109618 and CVE-2026-109619 as exploited, based on activity its honeypot network saw on October 21 (\u003Ca href=\"https:\u002F\u002Fwatchtowr.com\u002Fintelligence\u002Fphp-cve-2026-109618-faq\u002F?ref=ghost.jdneer.com\">watchTowr\u003C\u002Fa>). Cloudflare says it saw attack traffic against its customers after the details leaked, and that attackers kept changing their payloads to get past its rules. Its managed WAF rules have protected Free and paid plans by default since 3:02 AM UTC on October 21 (\u003Ca href=\"https:\u002F\u002Fblog.cloudflare.com\u002Fphp-vulnerabilities-waf-protection\u002F?ref=ghost.jdneer.com\">Cloudflare\u003C\u002Fa>). Precursor Security reports exploit attempts that use multipart\u002Fform-data requests with boundary values such as \u003Ccode>B7kQpoc618\u003C\u002Fcode> and \u003Ccode>B7kQpoc619\u003C\u002Fcode>. Those are worth searching for in web server and WAF logs (\u003Ca href=\"https:\u002F\u002Fwww.precursorsecurity.com\u002Fblog\u002Fphp2shell-critical-php-rce-vulnerabilities?ref=ghost.jdneer.com\">Precursor Security\u003C\u002Fa>). The CVEs aren't in CISA's Known Exploited Vulnerabilities catalog yet.\u003C\u002Fp>\n\u003Cp>Patched packages keep arriving. Fedora has submitted php 8.5.12 updates for Fedora 44, 45 and 46 and php 8.4.27 for Fedora 43. They're headed to updates-testing and aren't installable yet (\u003Ca href=\"https:\u002F\u002Fbodhi.fedoraproject.org\u002Fupdates\u002F?search=php&ref=ghost.jdneer.com\">Fedora Bodhi\u003C\u002Fa>). CloudLinux expects patched alt-php builds for PHP 5.2 through 8.5 within about five hours. It says cPanel's ea-php74 to ea-php85 are scheduled for EasyApache4 v25.91 and TuxCare ELS PHP packages are in testing (\u003Ca href=\"https:\u002F\u002Fcloudlinux.statuspage.io\u002Fincidents\u002Fzl0vt1yq3dj5?ref=ghost.jdneer.com\">CloudLinux status\u003C\u002Fa>). Rocky Linux and AlmaLinux haven't published PHP errata yet.\u003C\u002Fp>\n\u003Cp>If you run PHP on a public web server, patch tonight. If you can't, turn off \u003Ccode>session.upload_progress\u003C\u002Fcode>, apply PHP's \u003Ccode>memory_limit\u003C\u002Fcode> and \u003Ccode>post_max_size\u003C\u002Fcode> guidance, and put the site behind a WAF until you can.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 21, 11:10 PM PHT): TuxCare PHP ELS for Plesk\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Plesk's stock PHP 8.2 through 8.5 handlers are patched, but 7.4, 8.0 and 8.1 are still waiting on Plesk builds (\u003Ca href=\"https:\u002F\u002Fsupport.plesk.com\u002Fhc\u002Fen-us\u002Farticles\u002F44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk?ref=ghost.jdneer.com\">Plesk KB\u003C\u002Fa>). For EOL PHP that Plesk no longer patches on its own, the path is TuxCare Extended Lifecycle Support for PHP, installed through the \u003Ca href=\"https:\u002F\u002Fwww.plesk.com\u002Fextensions\u002Ftuxcare-php\u002F?ref=ghost.jdneer.com\">Plesk extension\u003C\u002Fa> (versions 5.6, 7.0 to 7.4, 8.0 and 8.1). As of CloudLinux's \u003Ca href=\"https:\u002F\u002Fcloudlinux.statuspage.io\u002Fincidents\u002Fzl0vt1yq3dj5?ref=ghost.jdneer.com\">status update at 14:55 UTC\u003C\u002Fa>, patched TuxCare ELS PHP packages are in testing and have not been released yet. Until they land, sites stuck on those handlers still need the interim mitigations (isolate the app or set \u003Ccode>session.upload_progress.enabled = Off\u003C\u002Fcode>).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 21, 10:55 PM PHT):\u003C\u002Fstrong> Ubuntu and Plesk have now shipped fixes, and NVD has published both CVEs.\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Ubuntu:\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fsecurity\u002Fnotices\u002FUSN-8948-1?ref=ghost.jdneer.com\">USN-8948-1\u003C\u002Fa> fixes CVE-2026-109618 and CVE-2026-109619 in php8.1 8.1.2-1ubuntu2.28 (Ubuntu 22.04 LTS) and php8.3 8.3.6-0ubuntu0.24.04.13 (Ubuntu 24.04 LTS), plus the php8.5 packages in Ubuntu's newer releases. Run \u003Ccode>sudo apt update && sudo apt upgrade\u003C\u002Fcode>, then restart PHP-FPM or Apache.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Plesk:\u003C\u002Fstrong> the \u003Ca href=\"https:\u002F\u002Fdocs.plesk.com\u002Frelease-notes\u002Fobsidian\u002Fchange-log\u002F?ref=ghost.jdneer.com\">Plesk Obsidian change log\u003C\u002Fa> lists a PHP update dated October 21 that moves Plesk's PHP 8.5, 8.4, 8.3 and 8.2 handlers to 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older handlers and the operating system's own PHP are not covered by this update.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>CloudLinux:\u003C\u002Fstrong> per its \u003Ca href=\"https:\u002F\u002Fcloudlinux.statuspage.io\u002Fincidents\u002Fzl0vt1yq3dj5?ref=ghost.jdneer.com\">status page\u003C\u002Fa>, alt-php and ea-php builds are in progress, with fixes targeted by 19:00 UTC (3 AM PHT, Oct 22). alt-php74 is already out for EL6 and EL10.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>NVD:\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-109618?ref=ghost.jdneer.com\">CVE-2026-109618\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-109619?ref=ghost.jdneer.com\">CVE-2026-109619\u003C\u002Fa> are now listed (awaiting NVD analysis).\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Still waiting:\u003C\u002Fstrong> Fedora, Rocky Linux, AlmaLinux and TuxCare ELS for PHP have not published fixed packages yet.\u003C\u002Fli>\n\u003Cli>There are still no public reports of exploitation in the wild, and the CVEs are not in CISA's Known Exploited Vulnerabilities catalog. GitHub is filling up with repositories claiming to be exploits for these bugs. None has been independently verified, and some fake PoCs run code on the machine of whoever runs them, so don't run them.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Update (Oct 21, 7:15 PM PHT):\u003C\u002Fstrong> A new third-party research repository, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002F9bie\u002Fphp2shell-bypass-aslr-exp?ref=ghost.jdneer.com\" rel=\"nofollow noopener\">9bie\u002Fphp2shell-bypass-aslr-exp\u003C\u002Fa> (created around 11:11 UTC on October 21), claims a standalone, pure-HTTP remote code execution path against a stock \u003Ccode>session_start()\u003C\u002Fcode> page with no application \u003Ccode>include\u003C\u002Fcode> or \u003Ccode>require\u003C\u002Fcode> file-inclusion sink, via the \u003Ccode>session.upload_progress\u003C\u002Fcode> multipart handler on PHP 8.4.26 with Apache prefork and mod_php. The writeup reports a two-request chain with ASLR off and a full chain with ASLR on (heap leak through \u003Ccode>Set-Cookie\u003C\u002Fcode>, libphp base leak, then \u003Ccode>zif_system\u003C\u002Fcode>), with lab success rates and accompanying tool scripts. This is independent research, not an official PHP Project confirmation. CVE-2026-109618 and CVE-2026-109619 remain unpublished on NVD and CVE.org, and php.net still shows only the October 20 advance notice with fixed builds due at 14:00 UTC (10:00 PM PHT). Treat trojanized or incomplete proof-of-concept code as common; do not run unverified exploit code against systems you do not own.\u003C\u002Fp>\n\u003Cp>Sources: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002F9bie\u002Fphp2shell-bypass-aslr-exp?ref=ghost.jdneer.com\" rel=\"nofollow noopener\">9bie\u002Fphp2shell-bypass-aslr-exp\u003C\u002Fa>; \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002F?ref=ghost.jdneer.com\">php.net\u003C\u002Fa>; NVD and CVE.org (no records yet for those IDs).\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 21, 4:55 PM PHT):\u003C\u002Fstrong> In \u003Ca href=\"https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-018\u002F?ref=ghost.jdneer.com\">Security Advisory 2026-018\u003C\u002Fa>, CERT-EU advises organisations to prepare for immediate patching and, \"where immediate patching is not feasible,\" to \"consider isolating internet-facing applications from public networks until a fix is available.\"\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Update (Oct 21, 11:40 AM PHT):\u003C\u002Fstrong> Ahead of PHP's scheduled fixes (14:00 UTC \u002F 10 PM PHT today), several public GitHub repositories appeared this morning with proof-of-concept and trigger code tagged to CVE-2026-109618 and CVE-2026-109619, along with detailed source-level writeups. The repositories do not agree on what the underlying bug is. One describes a use-after-free in PHP's session upload-progress handling, but calls it only \"conceptually validated\" against the PHP 8.4 source and says a full memory-corruption or code-execution reproduction is still incomplete. Another explicitly disputes the use-after-free theory and instead demonstrates a cookie-less session-fixation and session-poisoning chain on a stock PHP 8.4.4 Docker image, which reaches code execution only when the target application also has a separate file-inclusion flaw (an include() or require() that loads an attacker-controlled path). So far, no one has publicly shown a standalone, unauthenticated remote code execution from these flaws alone.\u003C\u002Fp>\n\u003Cp>As of this update, PHP has not yet published patched versions (the latest releases are still from September 24), neither CVE ID is listed on NVD or CVE.org, and there are no confirmed reports of exploitation in the wild. Treat the circulating proof-of-concept code as unverified community research until PHP publishes its official fixes and advisory tonight. One defensive step from the public writeups: setting \u003Ccode>session.upload_progress.enabled = 0\u003C\u002Fcode>, or at least keeping \u003Ccode>session.upload_progress.cleanup = On\u003C\u002Fcode> (the default), weakens the session-poisoning technique.\u003C\u002Fp>\n\u003Cp>Sources: GitHub repositories \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FZer061\u002FCVE-2026-109618?ref=ghost.jdneer.com\" rel=\"nofollow noopener\">Zer061\u002FCVE-2026-109618\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fgithub.com\u002F19h\u002FCVE-2026-109618?ref=ghost.jdneer.com\" rel=\"nofollow noopener\">19h\u002FCVE-2026-109618\u003C\u002Fa>; \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002Freleases\u002F?ref=ghost.jdneer.com\">PHP releases\u003C\u002Fa>; \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002F?ref=ghost.jdneer.com\">NVD\u003C\u002Fa>.\u003C\u002Fp>\n\u003C\u002Fdiv>\n\n\n\u003Cp>The PHP security team says it will ship an emergency security release on Wednesday, October 21, 2026, at 14:00 UTC, which is 10 PM Manila time, to fix two critical vulnerabilities. In an \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php?ref=ghost.jdneer.com#2026-10-20-1\">advance notice on php.net\u003C\u002Fa> posted October 20, the team said both flaws are \"rated CVSS v4.0 9.2\" and urged \"all PHP users\" to \"prepare now so they can upgrade as soon as the release is available.\"\u003C\u002Fp>\u003Cp>PHP has not said which versions are affected, which releases will carry the fixes, or what the bugs are. Its notice says: \"Full details, affected versions, and the fixed versions will be published with the release.\" The team also warned that it may move faster than planned: \"We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.\" PHP security team member Jakub Zelenka sent the same warning to the \u003Ca href=\"https:\u002F\u002Fnews-web.php.net\u002Fphp.internals\u002F132883?ref=ghost.jdneer.com\">php.internals mailing list\u003C\u002Fa> on October 20.\u003C\u002Fp>\u003Cp>Other reports have attached CVE numbers and broader claims about affected versions to these flaws, but PHP itself has not confirmed any of them yet. This post will be updated with the versions and CVE details once PHP publishes the release.\u003C\u002Fp>\u003Cp>For context, PHP's \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002Fsupported-versions.php?ref=ghost.jdneer.com\">supported versions page\u003C\u002Fa> lists four branches still receiving security fixes: 8.2, 8.3, 8.4 and 8.5. The most recent releases on those branches, per php.net, are 8.5.11, 8.4.26, 8.3.35 and 8.2.34. Older branches are end of life and get no official fixes.\u003C\u002Fp>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>Until PHP publishes the affected versions, assume any server running PHP is in scope and get ready to patch tonight.\u003C\u002Fp>\u003Col>\u003Cli>\u003Cstrong>Find every PHP install.\u003C\u002Fstrong> On each server, run \u003Ccode>php -v\u003C\u002Fcode> to see the command-line version. Web requests can use a different build, so also check what the web server runs: a temporary page calling \u003Ccode>phpinfo()\u003C\u002Fcode> shows it (delete that page right after), and \u003Ccode>php-fpm -v\u003C\u002Fcode> or a versioned binary such as \u003Ccode>php-fpm8.3 -v\u003C\u002Fcode> covers FPM pools.\u003C\u002Fli>\u003Cli>\u003Cstrong>Check containers and images.\u003C\u002Fstrong> Note the PHP base image tags in your Dockerfiles and CI, since those will need a rebuild once fixed images are out.\u003C\u002Fli>\u003Cli>\u003Cstrong>Sort by branch.\u003C\u002Fstrong> Anything on 8.2, 8.3, 8.4 or 8.5 should get an official fix. Anything older is end of life on php.net, so check whether your OS vendor or host backports security fixes, or plan an upgrade.\u003C\u002Fli>\u003Cli>\u003Cstrong>Book a patch window for tonight.\u003C\u002Fstrong> The release is set for 14:00 UTC (10 PM Manila, 10 AM US Eastern). Packaged PHP from distributions and hosting panels may arrive later than the php.net source release, so watch your vendor's channels too.\u003C\u002Fli>\u003Cli>\u003Cstrong>Prioritize internet-facing apps.\u003C\u002Fstrong> Put public sites, APIs and admin panels at the front of the queue.\u003C\u002Fli>\u003Cli>\u003Cstrong>Watch php.net.\u003C\u002Fstrong> Follow the \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002F?ref=ghost.jdneer.com\">php.net\u003C\u002Fa> homepage and the \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002Freleases\u002Ffeed.php?ref=ghost.jdneer.com\">releases feed\u003C\u002Fa>, and be ready earlier than planned, since PHP says it may release early.\u003C\u002Fli>\u003C\u002Fol>","The PHP security team will release fixes for two critical vulnerabilities, both rated CVSS v4.0 9.2, on October 21 at 14:00 UTC (10 PM Manila). Affected...",{"src":60,"width":73,"height":74,"type":75},1600,900,"image\u002Fpng","2026-10-22T23:53:00.000+08:00",{"name":78,"url":79,"owner":13},"Aiko Tanaka",null,[81,91,102,113],{"slug":82,"title":83,"excerpt":84,"image":85,"publishedAt":86,"topics":87,"readMinutes":90},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[88,89],{"key":64,"label":65},{"key":67,"label":68},1,{"slug":92,"title":93,"excerpt":94,"image":95,"publishedAt":96,"topics":97,"readMinutes":90},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[98,101],{"key":99,"label":100},"guides","Guides",{"key":67,"label":68},{"slug":103,"title":104,"excerpt":105,"image":106,"publishedAt":107,"topics":108,"readMinutes":90},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[109,112],{"key":110,"label":111},"opinion","Opinion",{"key":67,"label":68},{"slug":114,"title":115,"excerpt":116,"image":117,"publishedAt":118,"topics":119,"readMinutes":90},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[120,121],{"key":110,"label":111},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":125},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]