Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog Pretty Horrible Problem...
-
@GossiTheDog Pretty Horrible Problem...
@yetzt @GossiTheDog Pretty Hopeless Privacy
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog pretty horrible payload
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog
Well, that's shite. -
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog Oh, *rapture*.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog Did actual details of the issues leak, or just the fact that there's 2 CVEs and upcoming fixes?
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog welp, at least I have that day off from work
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog
Oh fun. EOD Thursday (at least in Europe).
And they couldn't release this earlier in the week because...?
(hey, at least they aren't aiming for 17:00 EDT on Friday, so let's count that as a win) -
@GossiTheDog Did actual details of the issues leak, or just the fact that there's 2 CVEs and upcoming fixes?
@Andres4NY @GossiTheDog that's what I was wondering
-
@GossiTheDog Did actual details of the issues leak, or just the fact that there's 2 CVEs and upcoming fixes?
I only know of the cited THAT, but no WHAT, no further details. Not even under any TLP-code.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog so concern is that anyone sitting on vulns will now rush to exploit before they can be patched?
Seems like this kind of thing could also be used without real vulnerabilities (but with a bunch of honeypots in place) to "shake the bushes" for any vulns that are being held.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog nice -
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
yikes
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
-
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
@GossiTheDog Oh jeeze, that will probably impact a whole bunch of appliances without a remediation path.
-
Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
@GossiTheDog Right. We had nothing to do anyways. Sigh 🤨
-
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
@GossiTheDog juicy, thanks
we have over 100 prod php servers, some difficult to reach for updates ...
