Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
@GossiTheDog Why in the name of god would you disable ASLR on a security appliance?
@mikesiegel palo never enabled it, and Citrix Netscaler is based on a decade old FreeBSD release which is EOL and doesn’t have ASLR support.
-
@GossiTheDog If you have a management interface facing the Internet on your firewall, you should reconsider your career.
@mauvehed @GossiTheDog in my experience it means you’re a small business that hired the absolute worst managed service provider so you’re PAYING for this
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog _eyes the iLO 4 ProLiant Gen8 servers in my homelab rack_
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog Oh dear (Shodan iLO4)
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog Is this the HPE self driving network I've heard so much about?
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog does HP still restrict firmware updates to active service contract holders for their servers? Because that was one thing that made me decide that I’d never recommend or purchase HP servers.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog at least all the consumer routers out there based on openwrt are unlikely to be affected - pretty sure PHP has never been part of that stack and I doubt companies using it as a base rewrote it fully in a new language.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog upgrade to what? Versions with fixes are still pending aren’t they?
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
@GossiTheDog
deny /usr/bin/id x
Systemwide protection against all exploits
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
For anyone else looking for PaloAlto's notice, it's here:
https://security.paloaltonetworks.com/CVE-2026-109618I'm waiting for it to say something other than ETA: TBD
Had a hard time finding it initially because google wants to send you to their unit42 writeup that covers their take on them protecting you from everyone else instead.
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog wasn’t that on Gen9 servers only which are EOS anyway? That was always the first thing I uninstalled on all machines
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/ -
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
-
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
ASLR supporting PHP exploits are coming, probably next week.. but it’s a really good security control (from decades ago) you should demand your vendors actually enable as it enabled time for orgs paying attention to patch.
The cybersecurity vendor industry itself is essentially negligent when it comes to this stuff. https://infosec.exchange/@catc0n/117487878549556020
-
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
-
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/@GossiTheDog neat page, though it just assumes versions like 7.4 are unfixed, whereas probably many are using Sury’s PHP which definitely patched it (and I think even 5.6).
There’s probably no better way though to track, so still a useful infographic
-
ASLR supporting PHP exploits are coming, probably next week.. but it’s a really good security control (from decades ago) you should demand your vendors actually enable as it enabled time for orgs paying attention to patch.
The cybersecurity vendor industry itself is essentially negligent when it comes to this stuff. https://infosec.exchange/@catc0n/117487878549556020
@GossiTheDog That toot says there's already a functional ASLR bypass poc out there...?
-
@GossiTheDog neat page, though it just assumes versions like 7.4 are unfixed, whereas probably many are using Sury’s PHP which definitely patched it (and I think even 5.6).
There’s probably no better way though to track, so still a useful infographic
@mig5 yeah if has clarifications for version numbers not being a bulletproof way. But still, orgs historically very bad at patching so it gives a rough indicator picture. Many are just on raw EOL versions, can also see they’re on EOL Redhat etc.
-
@GossiTheDog That toot says there's already a functional ASLR bypass poc out there...?
@christopherkunz there’s one on GitHub but it’s not super functional in reality.. plus people largely haven’t found it yet
it’d need more work to scale.
