FYI: Slackware -15.0 and -current changelogs note PHP vulnerability is patched.

For 15.0

Wed Oct 21 21:33:15 UTC 2026 extra/php80/php80-8.0.30-x86_64-2_slack15.0.txz: Rebuilt. This update fixes the following critical remote code execution flaw: Avoid state corruption via bailout. For more information, see: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp https://www.cve.org/CVERecord?id=CVE-2026-109618 https://www.cve.org/CVERecord?id=CVE-2026-109619 (* Security fix *) extra/php81/php81-8.1.34-x86_64-2_slack15.0.txz: Rebuilt. This update fixes the following critical remote code execution flaw: Avoid state corruption via bailout. For more information, see: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp https://www.cve.org/CVERecord?id=CVE-2026-109618 https://www.cve.org/CVERecord?id=CVE-2026-109619 (* Security fix *) extra/php82/php82-8.2.35-x86_64-1_slack15.0.txz: Upgraded. This update fixes bugs and security issues, including the following critical remote code execution flaw: Avoid state corruption via bailout. For more information, see: https://www.php.net/ChangeLog-8.php#8.2.35 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp https://www.cve.org/CVERecord?id=CVE-2026-109618 https://www.cve.org/CVERecord?id=CVE-2026-109619 (* Security fix *) patches/packages/php-7.4.33-x86_64-4_slack15.0.txz: Rebuilt. This update fixes the following critical remote code execution flaw: Avoid state corruption via bailout. For more information, see: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp https://www.cve.org/CVERecord?id=CVE-2026-109618 https://www.cve.org/CVERecord?id=CVE-2026-109619 (* Security fix *) 

For -current:

Wed Oct 21 21:33:15 UTC 2026 a/kernel-firmware-20261021_59f9fc2-noarch-1.txz: Upgraded. a/kernel-generic-7.2.12-x86_64-1.txz: Upgraded. ap/kexec-tools-2.0.32-x86_64-3.txz: Rebuilt. load-latest-kernel-initrd-with-kexec.sh: add reset_devices to the kernel command line. Some drivers need this to initialize properly from a dirty state with a kexec boot. Thanks to teoberi. ap/nano-9.3-x86_64-1.txz: Upgraded. d/kernel-headers-7.2.12-x86-1.txz: Upgraded. k/kernel-source-7.2.12-noarch-1.txz: Upgraded. l/brotli-1.2.1-x86_64-1.txz: Upgraded. l/nodejs-24.22.1-x86_64-1.txz: Upgraded. n/bind-9.20.30-x86_64-1.txz: Upgraded. This update fixes security issues: Crafted DNS messages could exhaust CPU while being parsed. Fix remote termination of named under concurrent GSS-TSIG traffic. Possible crash with redirect and qname-minimization strict. Fix a bug when resuming from a query initiated by RPZ. For more information, see: https://kb.isc.org/docs/CVE-2026-19630 https://kb.isc.org/docs/CVE-2026-94300 https://kb.isc.org/docs/CVE-2026-96888 https://kb.isc.org/docs/CVE-2026-97313 https://www.cve.org/CVERecord?id=CVE-2026-19630 https://www.cve.org/CVERecord?id=CVE-2026-94300 https://www.cve.org/CVERecord?id=CVE-2026-96888 https://www.cve.org/CVERecord?id=CVE-2026-97313 (* Security fix *) n/php-8.5.12-x86_64-1.txz: Upgraded. This update fixes bugs and security issues, including the following critical remote code execution flaw: Avoid state corruption via bailout. For more information, see: https://www.php.net/ChangeLog-8.php#8.5.12 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp https://www.cve.org/CVERecord?id=CVE-2026-109618 https://www.cve.org/CVERecord?id=CVE-2026-109619 (* Security fix *) isolinux/initrd.img: Rebuilt. kernels/*: Upgraded. usb-and-pxe-installers/usbboot.img: Rebuilt.