Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
3 Boosts
0 Likes
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
2 media files
Somebody has posted technical details of the PHP vulns.
There’s also another decent mitigation in this but the only real one is to patch.
The PHP situation will lead to a mass of incidents - it’s one of the biggest vulns in years.
Shodan dork "X-Powered-By: PHP/" - a majority are on EOL versions with no patch. It’s also more hosts as not everybody lists their PHP version in headers.
I think PHP probably has to bring forward the release as cyber vendors who have advanced notice told customers details so now everybody is running around with details.
There’s probably a conversation to be had about cyber vendors effectively reselling open-source project intelligence for profit. I don’t think it is great. Protecting the ivory tower sucks.
@GossiTheDog You're faster than most commercial services on the issues that matter 😉.
@GossiTheDog Happily, we do have apparmor already running, so thanks for the mini profile.
(I also have an alarm set up for a Fuck You Assholes three hour early wakeup to stagger over to a console in time for the patch drops. But, well.)
@GossiTheDog
Looks like Calif may have a PoC called php2shell that works against WordPress.