Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
@GossiTheDog well, use AI and risk getting known (and forgotten) because of it.
I know the AI company is much larger and powerful, and needs the markering hype to survive, but that seems to be the current tradeoff for using AI. -
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
@GossiTheDog given that it’s reasonably likely they were scraping chat sessions for hints on mathematical problems, it seems plausible to me that the same happened here.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog If you have a management interface facing the Internet on your firewall, you should reconsider your career.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog here's where I'd install the patch
-
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
Please let me sleep? * Poetry, that'll work. Come, sweet slumber. Enshroud me in thy purple cloak…
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog Why in the name of god would you disable ASLR on a security appliance?
-
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
-
Also update Citrix Netscaler boxes for PHP vuln, particularly if you have mgmt interface facing Internet. Why? You guessed it - ASLR is disabled.
@GossiTheDog@cyberplace.social lord help me i am so tired
-
@GossiTheDog Why in the name of god would you disable ASLR on a security appliance?
@mikesiegel palo never enabled it, and Citrix Netscaler is based on a decade old FreeBSD release which is EOL and doesn’t have ASLR support.
-
@GossiTheDog If you have a management interface facing the Internet on your firewall, you should reconsider your career.
@mauvehed @GossiTheDog in my experience it means you’re a small business that hired the absolute worst managed service provider so you’re PAYING for this
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog _eyes the iLO 4 ProLiant Gen8 servers in my homelab rack_
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog Oh dear (Shodan iLO4)
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog Is this the HPE self driving network I've heard so much about?
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog does HP still restrict firmware updates to active service contract holders for their servers? Because that was one thing that made me decide that I’d never recommend or purchase HP servers.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog at least all the consumer routers out there based on openwrt are unlikely to be affected - pretty sure PHP has never been part of that stack and I doubt companies using it as a base rewrote it fully in a new language.
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog upgrade to what? Versions with fixes are still pending aren’t they?
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
@GossiTheDog
deny /usr/bin/id x
Systemwide protection against all exploits
