Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.

[piggo@gs.rypak.cz]

@GossiTheDog juicy, thanks

we have over 100 prod php servers, some difficult to reach for updates ...

[khoos@infosec.exchange]

@sandorspruit @GossiTheDog so much for tomorrow

[sandorspruit@mastodon.nl]

@KHoos @GossiTheDog Had a nice and quiet day planned with some meaningful jobs to do. Oh, well ‍️

[yngmar@social.tchncs.de]

@piggo @GossiTheDog Don't worry, the first to break in will usually patch it for you.

[emd@cosocial.ca]

@GossiTheDog I had read that 8.0 and 8.1 would also be getting patches, is that not correct?

[privateger@plasmatrap.com]

@GossiTheDog@cyberplace.social oh god this will be bad

[wdormann@infosec.exchange]

@GossiTheDog
Looks like Calif may have a PoC called php2shell that works against WordPress.

[derickr@phpc.social]

@emd @GossiTheDog Not by the PHP team, but third parties might.

[derickr@phpc.social]

@dirkhh @GossiTheDog https://www.php.net/archive/2026.php#2026-10-20-1

[systemadminihater@cyberplace.social]

@wdormann @GossiTheDog Would be neat if you guys could let the patches come out before you tell everyone how to exploit it given there is nothing anyone can do.

[gossithedog@cyberplace.social]

A really good mitigation for this btw - AppArmor or SELinux.

Google something like apparmor restrict php from executing commands. Works against these CVEs.

Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.

[gerowen@mastodon.social]

@GossiTheDog I may look into this, though I'm not sure how restrictive I can get with mine since I use it to host Nextcloud, which has a variety of "apps", such as one that hooks into clamd to scan files for viruses when they're uploaded, etc. I'm not certain exactly how those work and if restricting the ability to execute commands would break certain expected functionality. I need to educate myself on AppArmor anyway; seems like a good excuse to sit down and do some reading.

[petrillic@hachyderm.io]

@GossiTheDog I’m convinced security vendors are, on average, substantially worse at security than any random vendor.

[tbodt@mastodon.social]

@GossiTheDog you're saying blocking your php from execve() fully mitigates this?

[afilina@phpc.social]

@emd @GossiTheDog If you're on an EOL version, I would suggest searching for "PHP commercial LTS".

[emd@cosocial.ca]

@afilina @GossiTheDog have to see how our devops platform (Laravel Forge) will handle.

But nice to know there might be other options, thanks for making me aware of these.

[systemadminihater@cyberplace.social]

@tbodt @GossiTheDog he has no idea

[filid@norden.social]

@GossiTheDog https://www.behindtheconsole.com/2026/10/21/patch-your-php-pre-2026-10-20/ this shell script helps to toggle the mitigation setting to
session.upload_progress.enabled = Off

[androcat@toot.cat]

@401matthall

That's gotta be the plan, right?

Force people to adopt unmaintainable slop fixes, to ensure they never will be able to get rid of that growing ball of technical debt and stay chained to the slop machines forever.

@GossiTheDog

[gmmds@mastodonapp.uk]

@GossiTheDog Any relation to Netscaler? There’s some php on there too. Or nothing to do with it?