Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
@GossiTheDog
Sure, but they knew about this since 2024!
So the main issue still is bad judgment on security here, as they invested their time and money obviously on other issues since then…@MarkusStoll I hate to alarm you but there are likely other known, bigger issues. They need funding.
-
@MarkusStoll I hate to alarm you but there are likely other known, bigger issues. They need funding.
@GossiTheDog
I strongly doubt that there was a bigger issue than this, as this makes it very clear to everyone that you should avoid using PHP.
Still I concur, that whoever uses it, should contribute to this… -
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
@GossiTheDog If OpenAI are claiming responsibility, ie admitting guilt, does that mean they're going to pay the costs?
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog Only an iota of humanity Please save my life by opening the link and seeing my story. Help me with one dollar or share
https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live -
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog and to be honest they're not the worst ones. At least they do have a budget, and core developers on the payroll. And many thanks to the @sovtechfund for that audit financing in 2024!
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
@f4grx @GossiTheDog it's also totally irrelevant whether it's good or bad (and what about C, C++ or anything else), you don't just "get rid of it" in the real world.
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog It is unreal that over $85k didn't reach the team because of fees!
For such thankless work (you know these processing companies are benefitting from PHP somewhere in their business), you'd think we could get them to wave some fees.
-
@f4grx @GossiTheDog it's also totally irrelevant whether it's good or bad (and what about C, C++ or anything else), you don't just "get rid of it" in the real world.
@corsac @GossiTheDog definitely lol
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog Maybe do it like this?
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog No hurries, hmm?
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog Said arse must be either very large, very itchy, or both.
That, or their build and test process is borked. -
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
sigh...
PAN: "oh, did you need your firewall to be safe and useful over the next week or so? huh. we'd never have guessed..."
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
Same with heartbleed and openssl at the time. Multi billion corporations should give a couple of millions.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog When the newest PAN-OS version is rocking PHP 8.0.30 I assume that they've got themselves into a delightful backport hole.
An entirely predictable one that is their fault, of course.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog i don't understand how these "security" people in companies buy from them
-
@GossiTheDog i don't understand how these "security" people in companies buy from them
@l33tname @GossiTheDog as a "security" person in a company, because the infrastructure was already there and you need some things to accomplish certain functions within the network.
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
Thanks for that post, I'm braindead today (recovering Flu/Covid microchips) hadn't realized you could tweak AppArmor/SELinux that way. I'll definitely be digging into that.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog I talked to the network engineers and they were just finishing patching for the last PA management plane RCE on Tuesday, lol. I was most concerned that this affected the public facing web service that hosts GlobalProtect VPN and HIP checks, but that seems to use a different scripting tech than PHP the management plane uses. Management is already ACLd off to just network management subnets, so the biggest risk is Panorama which has a wider audience.
I'm beginning to think that complex firewalls with deep packet inspection and SSL VPNs with client posture agents were a mistake, since the central choke point is already a forwarding performance problem (hard to get 100g-400g+traffic through a firewall reliably), the packet inspection screws you when signatures are added/changed silently invalidating something in your policy, securing these complex systems seems to be mission impossible, so the firewall is more liability than help.
-
@l33tname @GossiTheDog as a "security" person in a company, because the infrastructure was already there and you need some things to accomplish certain functions within the network.
@silhouette but don't you feel it decrease security overall?
