Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.

[fencepost@infosec.exchange]

@GossiTheDog so concern is that anyone sitting on vulns will now rush to exploit before they can be patched?

Seems like this kind of thing could also be used without real vulnerabilities (but with a bunch of honeypots in place) to "shake the bushes" for any vulns that are being held.

[condret@fedi.absturztau.be]

@GossiTheDog nice

[nullagent@partyon.xyz]

yikes

@GossiTheDog

[gossithedog@cyberplace.social]

PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619

Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35

All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.

https://www.php.net/archive/2026.php#2026-10-20-1

[huronbikes@cyberplace.social]

@GossiTheDog Oh jeeze, that will probably impact a whole bunch of appliances without a remediation path.

[sandorspruit@mastodon.nl]

@GossiTheDog Right. We had nothing to do anyways. Sigh 🤨

[piggo@gs.rypak.cz]

@GossiTheDog juicy, thanks

we have over 100 prod php servers, some difficult to reach for updates ...

[khoos@infosec.exchange]

@sandorspruit @GossiTheDog so much for tomorrow

[sandorspruit@mastodon.nl]

@KHoos @GossiTheDog Had a nice and quiet day planned with some meaningful jobs to do. Oh, well ‍️

[yngmar@social.tchncs.de]

@piggo @GossiTheDog Don't worry, the first to break in will usually patch it for you.

[emd@cosocial.ca]

@GossiTheDog I had read that 8.0 and 8.1 would also be getting patches, is that not correct?

[privateger@plasmatrap.com]

@GossiTheDog@cyberplace.social oh god this will be bad

[wdormann@infosec.exchange]

@GossiTheDog
Looks like Calif may have a PoC called php2shell that works against WordPress.

[derickr@phpc.social]

@emd @GossiTheDog Not by the PHP team, but third parties might.

[derickr@phpc.social]

@dirkhh @GossiTheDog https://www.php.net/archive/2026.php#2026-10-20-1

[systemadminihater@cyberplace.social]

@wdormann @GossiTheDog Would be neat if you guys could let the patches come out before you tell everyone how to exploit it given there is nothing anyone can do.

[gossithedog@cyberplace.social]

A really good mitigation for this btw - AppArmor or SELinux.

Google something like apparmor restrict php from executing commands. Works against these CVEs.

Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.

[gerowen@mastodon.social]

@GossiTheDog I may look into this, though I'm not sure how restrictive I can get with mine since I use it to host Nextcloud, which has a variety of "apps", such as one that hooks into clamd to scan files for viruses when they're uploaded, etc. I'm not certain exactly how those work and if restricting the ability to execute commands would break certain expected functionality. I need to educate myself on AppArmor anyway; seems like a good excuse to sit down and do some reading.

[petrillic@hachyderm.io]

@GossiTheDog I’m convinced security vendors are, on average, substantially worse at security than any random vendor.

[tbodt@mastodon.social]

@GossiTheDog you're saying blocking your php from execve() fully mitigates this?