Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
Thanks for that post, I'm braindead today (recovering Flu/Covid microchips) hadn't realized you could tweak AppArmor/SELinux that way. I'll definitely be digging into that.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog I talked to the network engineers and they were just finishing patching for the last PA management plane RCE on Tuesday, lol. I was most concerned that this affected the public facing web service that hosts GlobalProtect VPN and HIP checks, but that seems to use a different scripting tech than PHP the management plane uses. Management is already ACLd off to just network management subnets, so the biggest risk is Panorama which has a wider audience.
I'm beginning to think that complex firewalls with deep packet inspection and SSL VPNs with client posture agents were a mistake, since the central choke point is already a forwarding performance problem (hard to get 100g-400g+traffic through a firewall reliably), the packet inspection screws you when signatures are added/changed silently invalidating something in your policy, securing these complex systems seems to be mission impossible, so the firewall is more liability than help.
-
@l33tname @GossiTheDog as a "security" person in a company, because the infrastructure was already there and you need some things to accomplish certain functions within the network.
@silhouette but don't you feel it decrease security overall?
-
@l33tname @GossiTheDog as a "security" person in a company, because the infrastructure was already there and you need some things to accomplish certain functions within the network.
@silhouette @l33tname I love your domain name here
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog Our sysadmin and I are currently in the process of fixing the PHP2Shell mess on a couple of dozen sites, using obsolete PHP versions, which can't update, and we do it with a budget of 0, so color me unimpressed.
Also, burn PHP with fire.
-
@rogue_cells @GossiTheDog yarp perfect defense or nothing </sarcasm>
-
@GossiTheDog This argument has always been dumb as rocks.
Nobody @ me about entropy. This vulnerability, however severe, backed by more computing power than all non-AI technology combined, still hasn’t been exploited in one of the largest attack surfaces in the world, in all but perfect conditions with config parity.
The downsides of ALSR are tiny, and small bus messaging with large addresses spaces on the very, very fast hardware we have these days make it a no brainer to have enabled along with DEP and memory isolation if available to you.
Core pinning and isolation in conjunction with these mean all but the most dedicated attacks fail at the first hurdle. And I haven’t seen a single successful attack on systems with those in place.
They’re nearly impact-free and built in. I’d argue modern hardware should enforce this by default.
People literally balking at defence in depth measures because they can be defeated.
@ADHDruid @GossiTheDog Druid, do you think going through a class on physical security would help change their perspective? Not IT physical security but personal/family physical security? I still know much more about that type of physical security than computer security, and know a standard element of teaching it by many if not most/all is being a tougher target than others around you deters most attacks that are not targeted.
-
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
@GossiTheDog We all know that full-vehicle foam restraints from Demolition Man will never come to market. So, maybe choose a seatbelt over kissing the windscreen?
And, yes, it is a checkbox in preflight. Nice to hear it in a pilot's instructions to passengers. Better when they actually check and refuse to move until compliance.
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
Nextcloud, which is often touted as an European alternative to Google services, runs using PHP.
It doesn't seem like PHP is going away any time soon.
-
That's really Matt Mullenweg's decision. I'm not holding my breath.
@stuart @f4grx @GossiTheDog I’m sure Mullenweg will be happy to fund the PHP Foundation given his strong denunciation of freeloading by WP-Engine /s
-
So what Meta (who famously [edit: used to] use PHP extensively in what used to be their flagship product) spent on the complete failure that was the metaverse (~$60 billion) could have funded them at current levels for close to 100,000 years
@gbargoud @GossiTheDog Meta no longer uses PHP, they use their own reimplementation called Hack:
-
Nextcloud, which is often touted as an European alternative to Google services, runs using PHP.
It doesn't seem like PHP is going away any time soon.
@number6 @GossiTheDog I have zero doubt about that. I was ironic. I run several nextcloud instances and it's pretty good.
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
@GossiTheDog if only 100% of the setup tutorials I've seen in the past 20 years didn't start with "step 1: disable SELinux"
It's a pain in the butt, I understand, but here we are
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
@f4grx @GossiTheDog it is tho
I know it's an easy thing to say once shit happens, but I've been saying it for the last 20 years. Security is only one of many reasons and probably not the strongest one. -
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog I bugged QNAP about 2 hours after the patch was released. I only got a reply today from an account manager that he is checking with the technical team on the timeline for updated firmware that would have the fix.
I am not plugging the box back in until they have updated firmware with the fix
-
@GossiTheDog it's like saying
"Why wear a seatbelt, if you have a head on, you'll probably die anyway"
(biting my tongue before I say something rude)@tjbutt58 @GossiTheDog I prefer just banning airbags but requiring a pointed 8-10cm spike centered on every steering wheel.
Drive defensively. *Very* defensively.
-
@GossiTheDog I talked to the network engineers and they were just finishing patching for the last PA management plane RCE on Tuesday, lol. I was most concerned that this affected the public facing web service that hosts GlobalProtect VPN and HIP checks, but that seems to use a different scripting tech than PHP the management plane uses. Management is already ACLd off to just network management subnets, so the biggest risk is Panorama which has a wider audience.
I'm beginning to think that complex firewalls with deep packet inspection and SSL VPNs with client posture agents were a mistake, since the central choke point is already a forwarding performance problem (hard to get 100g-400g+traffic through a firewall reliably), the packet inspection screws you when signatures are added/changed silently invalidating something in your policy, securing these complex systems seems to be mission impossible, so the firewall is more liability than help.
@GossiTheDog Completing my thought from earlier, Firewalls were introduced at a time when endpoints had zero security controls to protect themselves, but that is no longer the case. With the better capabilities of the endpoint and the rise of end-to-end encryption for everything (tunneling over 443/tcp, the only port on the Internet) it probably makes more sense to invest in endpoint management and distribute as much security tooling as possible with centralized _management_ rather than centralized _networking_. Like I think it makes a ton of sense to put security policy and auditing into a browser extention (like uBlock) than trying to MITM all the clients, and obviously any client which can be managed has a perfectly suitable packet filter built-in. I think you could use the complex firewalls only for devices that you can't closely manage (appliances, IoT, etc.) and try to simplify the overall network filtering to stateless ACLs, just to reduce the amount of obvious garbage the endpoints have to deal with.
I dunno, maybe when the rubber hits the road this is unworkable in practice, but I think there is room to rethink where security controls make sense, when we have strong SSO and endpoint protection capabilities.
-
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/@GossiTheDog
Where's the offline and yet to patch number? -
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
@GossiTheDog Worse: the US is in such a dire education metric, that they'll profit even more from the slander.
-
@GossiTheDog It is unreal that over $85k didn't reach the team because of fees!
For such thankless work (you know these processing companies are benefitting from PHP somewhere in their business), you'd think we could get them to wave some fees.
@closingtags @GossiTheDog if my arithmetic is correct, they're paying 11.7% in fees, which seems... kinda high?
