Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
@GossiTheDog I sent claude after it just using the source code and the picture posted. Got a PoC working by the time I dropped the kid off at school.
@GossiTheDog Messing with getting a PoC. This doesn't seem to be a trivial exploit. ASLR has to be defeated through leak addresses, size of the memory has to be large enough, specific glibc has to be considered. While the entire platform of PHP is vulnerable, I don't think this is going to be a simple exploit to land.
-
@GossiTheDog is php 4 affected (asking for a friend)?
@CenturyAvocado @GossiTheDog Get with the times! (I'm on php 5)
-
@GossiTheDog Messing with getting a PoC. This doesn't seem to be a trivial exploit. ASLR has to be defeated through leak addresses, size of the memory has to be large enough, specific glibc has to be considered. While the entire platform of PHP is vulnerable, I don't think this is going to be a simple exploit to land.
-
@GossiTheDog More information, from various sources:
https://medium.com/@costin.raiu/php2shell-apocalypse-b8dae59dd753
https://cybersecuritynews.com/php-early-exploitation-attempts/
Exploitation attempts seem to have started, despite the lack of public weaponizable exploit.
-
The PHP situation will lead to a mass of incidents - it’s one of the biggest vulns in years.
Shodan dork "X-Powered-By: PHP/" - a lot are on EOL versions with no patch. It’s also more hosts as not everybody lists their PHP version in headers.
@GossiTheDog so glad I am retired from cyber security. Good luck, folks
-
@t_var_s @GossiTheDog One of the mitigations suggests disabling that.
-
@GossiTheDog @CenturyAvocado do the patches actually fix it as I'm seeing rumors that maybe not or another similar exploit
-
@GossiTheDog @CenturyAvocado urrgh
-
@GossiTheDog More information, from various sources:
https://medium.com/@costin.raiu/php2shell-apocalypse-b8dae59dd753
https://cybersecuritynews.com/php-early-exploitation-attempts/
Exploitation attempts seem to have started, despite the lack of public weaponizable exploit.
@GossiTheDog And even more. (Serious stuff starts after the comic at the beginning.):
-
@GossiTheDog yeah, I'm calling bs on this too. From a place of "having tried the poc", see e-mail for details.
https://chaos.social/@christopherkunz/117477368766737839@christopherkunz @GossiTheDog What if this was just some readiness test from counter-intelligence? Tomorrow is told there was no exploit. Only hundred thousand servers rummaging through launchpad for software updates.
-
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
@GossiTheDog According to the post below, 8.5.12 introduced a new vulnerability
https://fedi.katze.sh/@elise/117479383739450605
(edit: no, different vuln, I missed the details earlier in their thread)
-
@GossiTheDog Ah yes sorry, you are right - the first part of their thread did not cross my eyes at first
-
@GossiTheDog agreed
-
@GossiTheDog Especially with companies breaking the embargo.
-
@FediThing @nemo @GossiTheDog as someone that has a particular interest and hobby into talking and exploring the hobbyist maintainer side of things... this is an actually well funded and managed project compared to the vast majority of what runs the internet.
The PHP foundation is easily in the top1% if not the top 0.1% of these FOSS projects in term of resources.
I know it is even worse said like that but... yeeeeeep
-
@fedipete @GossiTheDog where 4 art thou, PKI?
-
You wrote "... it’s mostly volunteers powering the internet while almost everybody freeloads off ‘em, tale as old as, well, the internet."
Hmmn, I've been reading economic philosophies in passing, am]nd notice freeloading seems to be something every system seems to have to face.
Which have been studied, sometimes to death...
Anyone in economics here?
If not, please boost for reach -
@FediThing @nemo @GossiTheDog I mean... I don't see this as so negative. I see this as a positive. These companies have massive rosters of devs and can barely do anything close to what the volunteers do. It shows they are just.. bad at this and not a danger.
-
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
