Actually, the .12 had fixes for other PHP CVEs.
But it was a .13 that did fix the CVEs in question (which are remote code executions).

The repositories were being hammered and the fix was delayed for most people.

Excerpt:

Changes for php8.3 (php8.3-zip php8.3-xml php8.3-readline php8.3-opcache php8.3-cli php8.3-phpdbg php8.3-mysql php8.3-mbstring php8.3-gd php8.3-fpm php8.3-dev php8.3-curl php8.3-cgi php8.3-bcmath php8.3-common) ---
php8.3 (8.3.6-0ubuntu0.24.04.13) noble-security; urgency=medium

    * SECURITY UPDATE: Remote RCE via state corruption issue
        - debian/patches/CVE-2026-109618_109619.patch: Avoid state corruption via
            bailout in Zend/tests/bug40770.phpt, Zend/tests/bug54268.phpt, ...
        - CVE-2026-109618
        - CVE-2026-109619

  -- Marc Deslauriers Mon, 19 Oct 2026 11:16:58 -0400

Although it says Monday 19 Oct, it was not available in the repositories (embargoed) until 10 am Eastern Wednesday 20th of Oct.

But the repository being under load delayed that for most people.

As much as it can apply to online communities in general including slashdot, Reddit and reddit-likes *really* take the cake for creating circle-jerk communities. Creating niche communities with moderators that ban at any comment they didn't want to see. Saw a reply to one of my comments that I thought to be a bit dumb (basically, that we should replace TLS certificates with blockchain), but not horribly unforgiveable or anything, and the comment got removed and the user banned from the community. Mod saw 'blockchain' and while I understand a negative gut reaction, nothing that should have rated a moderator going that far.

If you are using a distro with long term support (LTS), like I am, they backport the patch to the version that they have.

I am on Ubuntu Server 24.04 LTS, and the change was from

8.3.6-0ubuntu0.24.04.11
To
8.3.6-0ubuntu0.24.04.12

So, .11 to .12.

This should have been posted before 10 am EDT.

Ubuntu LTS (26.04, 24,04, and 22.04) got the fix yesterday, as patches to the existing PHP version.

This is from 24.04:

Upgraded:
        php8.3-bcmath:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-cgi:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-cli:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-common:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-curl:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-dev:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-fpm:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-gd:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-mbstring:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-mysql:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-opcache:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-phpdbg:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-readline:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-xml:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12
        php8.3-zip:amd64 8.3.6-0ubuntu0.24.04.11 => 8.3.6-0ubuntu0.24.04.12

There is now a PHP2Shell.

... an attacker without a login can run code on Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS. The exploit tool PHP2Shell, credited to Calif, combines both bugs into one attack that needs no login.

There will be lots of hacked sites in the coming days and weeks.

Alternatively, some people in that subreddit can't stand that anyone could express valid concerns about Tesla and decides that it must be some irrational, inexplicable blind anti-Tesla rather than informed and real concerns.

Not to worry, recall that Musk *also* has ambitions of X being a finance company, so voila, every child can have an 'X brokerage account' waiting for them with a share in it. Now he gets every child defaulting to his network, no problem.

I don't think a grant of one share of a specific stock will be a particularly educational event. I think generally in school a teach will, at some point, do a more educational exercise where students are actually doing mock trading and, critically, trying to evaluate different companies and make predictions on where things will go.

How about this for punditry?

Cringley thinks Apple and Intel are merging.

Also, there has been a recurring comment here on Slashdot about Robert X Cringley, with all sorts of claims allegedly made by him. However, it is posted anonymously, and does not provide sources..

The "working at Apple as employee #12" part appears on a speaker biography.

The same bio also says he taught for several years at Stanford.

This Reddit comment says that he claimed he has a PhD from Stanford when he worked at Infoworld.

This page has more of his claims (invented the trash can icon, ...), and details his foray into Kickstarter and Minecraft.

So, lots of questions about him, to say the least ...

Yeah, that latter one basically focused on the fact the output looked verbatim like the 'training' material, so the judgement was that AI was more an excuse than a demonstrable transformative thing.

Note in some other case I recall the AI company arguing that the ingest and training of material is 'transformative' but the engines could be used to violate copyright, but then the *operator* would be on the hook for infringement, as the operator supplied the prompt that resulted in infringement.

There was also that OpenAI deal with Disney that was going to let Disney characters be used in OpenAI output but that got dropped. Lots of mixed assumptions in play with the AI companies asserting that they don't need permission, getting permission or forcing permission anyway, and shifting responsibility to the users.

Even if it exactly works as advertised, if you thought a rock kicked up by a tire was bad, just wait....

- It's impossible to prove anything. Somalia was in the midst of a civil war, there are no records.

The civil war is not even the case.
I have a Somali friend who was born perhaps two decades before the civil war started in 1990.

He told me that he does not know when he was born, simply because there are no birth records in Somalia. He needed this info to apply for something in a Western country.

He said the only way to know for sure is to go to the village elders who will remember when he was born based on a certain event (natural disaster, war, or other notable event).

With people displaced and such in the civil war, it could only be worse ...

And thanks to hiring 1,000 new people to patch it, now they have N * 1.5 vulnerabilities!

I meant infested, not invested

*You* would not want this.

However on endpoints vaguely related to your work, your employer *loves* excuses to give Microsoft money to invest as many endpoints as possible.

Nowhere in this do I see how maintaining the history in this manner even benefits AI. I haven't seen evidence that it can benefit from an insanely over-granular change history.

This is not debating the volume of code, it's the granularity of delivering it as tiny 'changesets'. Just because you *can* create a system that can partition changes into 3 second intervals does not mean there's any value for machine nor human in doing so.