Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
Nextcloud, which is often touted as an European alternative to Google services, runs using PHP.
It doesn't seem like PHP is going away any time soon.
@number6 @GossiTheDog I have zero doubt about that. I was ironic. I run several nextcloud instances and it's pretty good.
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
@GossiTheDog if only 100% of the setup tutorials I've seen in the past 20 years didn't start with "step 1: disable SELinux"
It's a pain in the butt, I understand, but here we are
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
@f4grx @GossiTheDog it is tho
I know it's an easy thing to say once shit happens, but I've been saying it for the last 20 years. Security is only one of many reasons and probably not the strongest one. -
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog I bugged QNAP about 2 hours after the patch was released. I only got a reply today from an account manager that he is checking with the technical team on the timeline for updated firmware that would have the fix.
I am not plugging the box back in until they have updated firmware with the fix
-
@GossiTheDog it's like saying
"Why wear a seatbelt, if you have a head on, you'll probably die anyway"
(biting my tongue before I say something rude)@tjbutt58 @GossiTheDog I prefer just banning airbags but requiring a pointed 8-10cm spike centered on every steering wheel.
Drive defensively. *Very* defensively.
-
@GossiTheDog I talked to the network engineers and they were just finishing patching for the last PA management plane RCE on Tuesday, lol. I was most concerned that this affected the public facing web service that hosts GlobalProtect VPN and HIP checks, but that seems to use a different scripting tech than PHP the management plane uses. Management is already ACLd off to just network management subnets, so the biggest risk is Panorama which has a wider audience.
I'm beginning to think that complex firewalls with deep packet inspection and SSL VPNs with client posture agents were a mistake, since the central choke point is already a forwarding performance problem (hard to get 100g-400g+traffic through a firewall reliably), the packet inspection screws you when signatures are added/changed silently invalidating something in your policy, securing these complex systems seems to be mission impossible, so the firewall is more liability than help.
@GossiTheDog Completing my thought from earlier, Firewalls were introduced at a time when endpoints had zero security controls to protect themselves, but that is no longer the case. With the better capabilities of the endpoint and the rise of end-to-end encryption for everything (tunneling over 443/tcp, the only port on the Internet) it probably makes more sense to invest in endpoint management and distribute as much security tooling as possible with centralized _management_ rather than centralized _networking_. Like I think it makes a ton of sense to put security policy and auditing into a browser extention (like uBlock) than trying to MITM all the clients, and obviously any client which can be managed has a perfectly suitable packet filter built-in. I think you could use the complex firewalls only for devices that you can't closely manage (appliances, IoT, etc.) and try to simplify the overall network filtering to stateless ACLs, just to reduce the amount of obvious garbage the endpoints have to deal with.
I dunno, maybe when the rubber hits the road this is unworkable in practice, but I think there is room to rethink where security controls make sense, when we have strong SSO and endpoint protection capabilities.
-
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/@GossiTheDog
Where's the offline and yet to patch number? -
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
@GossiTheDog Worse: the US is in such a dire education metric, that they'll profit even more from the slander.
-
@GossiTheDog It is unreal that over $85k didn't reach the team because of fees!
For such thankless work (you know these processing companies are benefitting from PHP somewhere in their business), you'd think we could get them to wave some fees.
@closingtags @GossiTheDog if my arithmetic is correct, they're paying 11.7% in fees, which seems... kinda high?
-
@GossiTheDog Completing my thought from earlier, Firewalls were introduced at a time when endpoints had zero security controls to protect themselves, but that is no longer the case. With the better capabilities of the endpoint and the rise of end-to-end encryption for everything (tunneling over 443/tcp, the only port on the Internet) it probably makes more sense to invest in endpoint management and distribute as much security tooling as possible with centralized _management_ rather than centralized _networking_. Like I think it makes a ton of sense to put security policy and auditing into a browser extention (like uBlock) than trying to MITM all the clients, and obviously any client which can be managed has a perfectly suitable packet filter built-in. I think you could use the complex firewalls only for devices that you can't closely manage (appliances, IoT, etc.) and try to simplify the overall network filtering to stateless ACLs, just to reduce the amount of obvious garbage the endpoints have to deal with.
I dunno, maybe when the rubber hits the road this is unworkable in practice, but I think there is room to rethink where security controls make sense, when we have strong SSO and endpoint protection capabilities.
@raven667 @GossiTheDog Hate to break this to you but this is just likely to get worse, and stateful ACLs at the border save client access IPv6's behind. I'm not just kicking the tyres but I'm in skunkworks, Baldrick has a cunning plan
-
@GossiTheDog I talked to the network engineers and they were just finishing patching for the last PA management plane RCE on Tuesday, lol. I was most concerned that this affected the public facing web service that hosts GlobalProtect VPN and HIP checks, but that seems to use a different scripting tech than PHP the management plane uses. Management is already ACLd off to just network management subnets, so the biggest risk is Panorama which has a wider audience.
I'm beginning to think that complex firewalls with deep packet inspection and SSL VPNs with client posture agents were a mistake, since the central choke point is already a forwarding performance problem (hard to get 100g-400g+traffic through a firewall reliably), the packet inspection screws you when signatures are added/changed silently invalidating something in your policy, securing these complex systems seems to be mission impossible, so the firewall is more liability than help.
@raven667 @GossiTheDog Who is doing HIP in prod? inquiring minds want to know... Ah. Wrong HIP. Never mind.
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog
The company that shows up in everyone's httpd access logs with the weirdly verbose user-agent string? -
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog Palo Alto report indicating successful exploitation of php2shell but the report is very vague and does not state php2shell was exploited. Thoughts? https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
-
@8tpercent @GossiTheDog does anyone know if Asustor or QNAP login portals use unpatched PHP versions? They seem to only mention PHP installations on the NAS, not the portals themselves (Synology explains that theirs doesn't), and if I'm not wrong, their remote connection capabilities mean someone could access them remotely without the manager/owner knowing at all.
A little more info...
https://synopower.club/synology-php2shell-emergency-patch/
Could only find this...which was updated yesterday, so only a few apps to fix...
-
@ADHDruid @GossiTheDog Druid, do you think going through a class on physical security would help change their perspective? Not IT physical security but personal/family physical security? I still know much more about that type of physical security than computer security, and know a standard element of teaching it by many if not most/all is being a tougher target than others around you deters most attacks that are not targeted.
@CliffsEsport @GossiTheDog I think more people need to understand opsec and first principles. You’re definitely onto something
-
If you use Palo-Alto firewalls, make sure you upgrade for the PHP vulns.
In particular, if you have the mgmt interface facing the internet upgrade those now. The Palo-Alto firewall VMs have ASLR disabled which makes exploitation trivial.
@GossiTheDog EVERYONE. Stop with the mgmt exposed interfaces. Are you that LAZY? Urgh.
-
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches available now. https://security.paloaltonetworks.com/CVE-2026-109618
-
Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches available now. https://security.paloaltonetworks.com/CVE-2026-109618
@GossiTheDog bon après, en théorie, ce n’est pas l’équipement le plus exposé
Enfin sa GUI. -
Palo-Alto moved their patch dates for PHP2Shell up after that toot, patches available now. https://security.paloaltonetworks.com/CVE-2026-109618
@GossiTheDog I bet it sucks to be Palo's PHP-wrangler; but I'm morbidly curious what internal fork hell is implied by the gradually shifting ETAs. Last week they were all much closer together; over the weekend a few actually shipped ahead of schedule; while others have been pushed all the way to friday, including some of newer PAN-OS versions.
