Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
sigh...
PAN: "oh, did you need your firewall to be safe and useful over the next week or so? huh. we'd never have guessed..."
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
Same with heartbleed and openssl at the time. Multi billion corporations should give a couple of millions.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog When the newest PAN-OS version is rocking PHP 8.0.30 I assume that they've got themselves into a delightful backport hole.
An entirely predictable one that is their fault, of course.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog i don't understand how these "security" people in companies buy from them
-
@GossiTheDog i don't understand how these "security" people in companies buy from them
@l33tname @GossiTheDog as a "security" person in a company, because the infrastructure was already there and you need some things to accomplish certain functions within the network.
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
Thanks for that post, I'm braindead today (recovering Flu/Covid microchips) hadn't realized you could tweak AppArmor/SELinux that way. I'll definitely be digging into that.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog I talked to the network engineers and they were just finishing patching for the last PA management plane RCE on Tuesday, lol. I was most concerned that this affected the public facing web service that hosts GlobalProtect VPN and HIP checks, but that seems to use a different scripting tech than PHP the management plane uses. Management is already ACLd off to just network management subnets, so the biggest risk is Panorama which has a wider audience.
I'm beginning to think that complex firewalls with deep packet inspection and SSL VPNs with client posture agents were a mistake, since the central choke point is already a forwarding performance problem (hard to get 100g-400g+traffic through a firewall reliably), the packet inspection screws you when signatures are added/changed silently invalidating something in your policy, securing these complex systems seems to be mission impossible, so the firewall is more liability than help.
-
@l33tname @GossiTheDog as a "security" person in a company, because the infrastructure was already there and you need some things to accomplish certain functions within the network.
@silhouette but don't you feel it decrease security overall?
-
@l33tname @GossiTheDog as a "security" person in a company, because the infrastructure was already there and you need some things to accomplish certain functions within the network.
@silhouette @l33tname I love your domain name here
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog Our sysadmin and I are currently in the process of fixing the PHP2Shell mess on a couple of dozen sites, using obsolete PHP versions, which can't update, and we do it with a budget of 0, so color me unimpressed.
Also, burn PHP with fire.
-
@rogue_cells @GossiTheDog yarp perfect defense or nothing </sarcasm>
-
@GossiTheDog This argument has always been dumb as rocks.
Nobody @ me about entropy. This vulnerability, however severe, backed by more computing power than all non-AI technology combined, still hasn’t been exploited in one of the largest attack surfaces in the world, in all but perfect conditions with config parity.
The downsides of ALSR are tiny, and small bus messaging with large addresses spaces on the very, very fast hardware we have these days make it a no brainer to have enabled along with DEP and memory isolation if available to you.
Core pinning and isolation in conjunction with these mean all but the most dedicated attacks fail at the first hurdle. And I haven’t seen a single successful attack on systems with those in place.
They’re nearly impact-free and built in. I’d argue modern hardware should enforce this by default.
People literally balking at defence in depth measures because they can be defeated.
@ADHDruid @GossiTheDog Druid, do you think going through a class on physical security would help change their perspective? Not IT physical security but personal/family physical security? I still know much more about that type of physical security than computer security, and know a standard element of teaching it by many if not most/all is being a tougher target than others around you deters most attacks that are not targeted.
-
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
@GossiTheDog We all know that full-vehicle foam restraints from Demolition Man will never come to market. So, maybe choose a seatbelt over kissing the windscreen?
And, yes, it is a checkbox in preflight. Nice to hear it in a pilot's instructions to passengers. Better when they actually check and refuse to move until compliance.
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
Nextcloud, which is often touted as an European alternative to Google services, runs using PHP.
It doesn't seem like PHP is going away any time soon.
-
That's really Matt Mullenweg's decision. I'm not holding my breath.
@stuart @f4grx @GossiTheDog I’m sure Mullenweg will be happy to fund the PHP Foundation given his strong denunciation of freeloading by WP-Engine /s
-
So what Meta (who famously [edit: used to] use PHP extensively in what used to be their flagship product) spent on the complete failure that was the metaverse (~$60 billion) could have funded them at current levels for close to 100,000 years
@gbargoud @GossiTheDog Meta no longer uses PHP, they use their own reimplementation called Hack:
-
Nextcloud, which is often touted as an European alternative to Google services, runs using PHP.
It doesn't seem like PHP is going away any time soon.
@number6 @GossiTheDog I have zero doubt about that. I was ironic. I run several nextcloud instances and it's pretty good.
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
@GossiTheDog if only 100% of the setup tutorials I've seen in the past 20 years didn't start with "step 1: disable SELinux"
It's a pain in the butt, I understand, but here we are
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
@f4grx @GossiTheDog it is tho
I know it's an easy thing to say once shit happens, but I've been saying it for the last 20 years. Security is only one of many reasons and probably not the strongest one. -
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog I bugged QNAP about 2 hours after the patch was released. I only got a reply today from an account manager that he is checking with the technical team on the timeline for updated firmware that would have the fix.
I am not plugging the box back in until they have updated firmware with the fix
