Skip to content
PHP Vulnerabilities in Fedora Rubygem Gist

PHP Vulnerabilities in Fedora Rubygem Gist

First seen 4 Nov 2026, 08:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 4, 2026 at 08:51 UTC
  • •Two critical PHP vulnerabilities in Fedora rubygem-gist allow unauthenticated code execution.
  • •CVE-2026-105221 has a CVSS score of 9.1, indicating critical severity.
  • •A patch was released on October 26, 2026; users should update immediately.

Two PHP vulnerabilities (CVE-2026-105221) have been identified in the Fedora rubygem-gist package, allowing attackers to execute code without authentication. The flaws affect various setups and PHP versions, with a CVSS score of 9.1, indicating a severity. The vulnerabilities stem from improper TLS certificate validation, which could lead to traffic interception and credential theft. A patch has been released as of October 26, 2026, to address these issues. Users are urged to update their systems using the 'dnf' update program. The vulnerabilities were publicly disclosed on October 4, 2026, with proof-of-concept code available shortly thereafter.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-10-04
CVE-2026-105221 published
Critical vulnerabilities in Fedora rubygem-gist disclosed, allowing code execution without authentication.
Linuxsecurity
2026-10-06
First public PoC released
Proof-of-concept code for CVE-2026-105221 made publicly available, increasing risk of exploitation.
Linuxsecurity
2026-10-26
Patch released
Fedora released an update to fix the vulnerabilities in rubygem-gist; users advised to upgrade.
Linuxsecurity

More articles in this cluster (4)

Following this threat?

Track Fedora and CVE-2026-105221 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

Which versions of Fedora are affected?
The vulnerabilities affect various setups using the rubygem-gist package, particularly those with vulnerable PHP versions.
What should I do if I am using rubygem-gist?
Immediately apply the latest update using the 'dnf' update program to mitigate the vulnerabilities.
Is there any evidence of exploitation in the wild?
While proof-of-concept code exists, there is no confirmed exploitation reported in the wild at this time.