Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
I call dibs on this.
See my comments here at line 573. I also ran into longjmp problems and solved them also.
Unfortunately the PHP team only wanted a quick oneline fix of the handler which later bit them again on pipelined http requests.
https://github.com/gmoniker/php-apache2handler/commit/11aa93f85afcf837fd299b3557191f00cc026ec9
-
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
And as always these days, if you get news from a media source that is played by this, reconsider keeping them as a media source.
-
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
@GossiTheDog it’s a more advanced case of tag hijacking.
-
Regarding the rumours the PHP patches don’t fix the vulnerabilities - it’s not true, they patched the vulnerabilities of issue.
The rumours are also separate issue which people are mixing up. Don’t panic about that one.
-
@GossiTheDog well, use AI and risk getting known (and forgotten) because of it.
I know the AI company is much larger and powerful, and needs the markering hype to survive, but that seems to be the current tradeoff for using AI. -
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
@GossiTheDog given that it’s reasonably likely they were scraping chat sessions for hints on mathematical problems, it seems plausible to me that the same happened here.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog If you have a management interface facing the Internet on your firewall, you should reconsider your career.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog here's where I'd install the patch
-
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
Please let me sleep? * Poetry, that'll work. Come, sweet slumber. Enshroud me in thy purple cloak…
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog Why in the name of god would you disable ASLR on a security appliance?
-
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
-
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
@GossiTheDog@cyberplace.social lord help me i am so tired
-
@GossiTheDog Why in the name of god would you disable ASLR on a security appliance?
@mikesiegel palo never enabled it, and Citrix Netscaler is based on a decade old FreeBSD release which is EOL and doesn’t have ASLR support.
-
@GossiTheDog If you have a management interface facing the Internet on your firewall, you should reconsider your career.
@mauvehed @GossiTheDog in my experience it means you’re a small business that hired the absolute worst managed service provider so you’re PAYING for this
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog _eyes the iLO 4 ProLiant Gen8 servers in my homelab rack_
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog Oh dear (Shodan iLO4)
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog Is this the HPE self driving network I've heard so much about?
