Discussion
Updated apt in ubuntu and got updates to libapache2-mod-php8.1, php8.1-cli, php8.1-common, php8.1-mysql, php8.1-opcache, php8.1-readline.
Sounds like I have the fixes for the php megabug. Is there anything I can do, either before or after re-enabling my apache server, to specifically test whether I'm vulnerable?
@hikari i am unclear whether the Ubuntu patch is the standard one. There is a document I know exists but have not yet read. Lot happeni [30 second uncontrollable coughing fit, grabs inhaler, uses enhaler] lot happening today.
@mcc also frankly I don't know if I trust that the “full” patch is sufficiently complete. I am just going to keep my PHP services down for a while
@mcc ohh the 8.1 patch just makes the process exit(1) on OOM. that… might be a more robust fix than the full patch ^^; https://github.com/php/php-src/commit/1d7dec178a094e6e75b229ce22754045f8c6070a
@hikari Regardless of mechanism, I am interpreting this notice
https://lists.ubuntu.com/archives/ubuntu-security-announce/2026-October/011433.html
To mean that version 8.1.2-1ubuntu2.28 is protected from the two CVEs today, regardless of whether base 8.1.2 is.
Okay ( and thanks @gizmomathboy ) nice, nice, now we're talking.
Local-only exploit tester.
So now I just have to decide whether to trust… running PHP code on my server… written by an unknown third party… whose github is overflowing with AI slop.
https://github.com/slabbdev/php2shell-cve-2026-109618-109619
…oh. Hm. Maybe I didn't think through the implications of trawling the internet looking for vulnerability exploits to run on my server
@mcc yeah, strange and interesting times, in the worst possible ways
ME: I need someone to hack my server
PERSON ON GITHUB: I can perform that service
@mcc There's some mitigation steps or how to detect if you were hit on this page, see "Checking for a compromise afterwards":
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
@oli Thanks. I'm going to start by looking for writeups that don't come from an admitted AI user but I'll try that if I can't find anything else.
Install Fedizen
Get the full app experience
@mcc as I understand it only the PHP versions that are being actively supported got the “full” patch. the PHP 8.1 patch is a minimal mitigation and I don't personally trust it to be especially robust