Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
The PHP situation will lead to a mass of incidents - it’s one of the biggest vulns in years.
Shodan dork "X-Powered-By: PHP/" - a lot are on EOL versions with no patch. It’s also more hosts as not everybody lists their PHP version in headers.
@GossiTheDog Greenland looks good
-
Somebody has posted technical details of the PHP vulns. It’s likely LLM generated from GitHub commits (or somewhere!) but it’s in the right ballpark on one of the issues.
There’s also another decent mitigation in this but the only real one is to patch.
@GossiTheDog This is LLM-written (evidence for claim: A - the entire text flags 100% in Pangram, which anecdotally is not perfect but is pretty good. B. the credited author ( https://x.com/J4ck3LSyN ) sounds nothing like this on their Twitter and people don't change their voice so easily)
I don't say this to entirely disparage it - lots of hackers do this currently to put their conclusions in "nice" writing, and the conclusions might be right. But I'd be careful if you can't follow the claims.
-
@GossiTheDog Greenland looks good
@george @GossiTheDog
That's only because of the Mercator projection -
The PHP situation will lead to a mass of incidents - it’s one of the biggest vulns in years.
Shodan dork "X-Powered-By: PHP/" - a lot are on EOL versions with no patch. It’s also more hosts as not everybody lists their PHP version in headers.
I think PHP probably has to bring forward the release as cyber vendors who have advanced notice told customers details so now everybody is running around with details.
There’s probably a conversation to be had about cyber vendors effectively reselling open-source project intelligence for profit. I don’t think it is great. Protecting the ivory tower sucks.
-
@GossiTheDog This is LLM-written (evidence for claim: A - the entire text flags 100% in Pangram, which anecdotally is not perfect but is pretty good. B. the credited author ( https://x.com/J4ck3LSyN ) sounds nothing like this on their Twitter and people don't change their voice so easily)
I don't say this to entirely disparage it - lots of hackers do this currently to put their conclusions in "nice" writing, and the conclusions might be right. But I'd be careful if you can't follow the claims.
@spacefinner @GossiTheDog thank you for noticing that and flagging it! I agree, and I really wish every vuln disclosure wasn't written like this now :?
-
Somebody has posted technical details of the PHP vulns. It’s likely LLM generated from GitHub commits (or somewhere!) but it’s in the right ballpark on one of the issues.
There’s also another decent mitigation in this but the only real one is to patch.
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
@GossiTheDog All the the Docker containers that are only updated with every application release will also have a fun time
-
I think PHP probably has to bring forward the release as cyber vendors who have advanced notice told customers details so now everybody is running around with details.
There’s probably a conversation to be had about cyber vendors effectively reselling open-source project intelligence for profit. I don’t think it is great. Protecting the ivory tower sucks.
The screenshot in this tweet is real. https://infosec.exchange/@wdormann/117475540081194496
-
The screenshot in this tweet is real. https://infosec.exchange/@wdormann/117475540081194496
@GossiTheDog Viss also uploaded the video to fedi :3
via @Viss
-
@GossiTheDog https://www.behindtheconsole.com/2026/10/21/patch-your-php-pre-2026-10-20/ this shell script helps to toggle the mitigation setting to
session.upload_progress.enabled = Off@filid @GossiTheDog According to Heise, changing this parameter won't help https://www.heise.de/news/Wichtige-PHP-Updates-am-21-Oktober-beheben-Codeeinschleusung-Schwachstellen-11495072.html
-
The screenshot in this tweet is real. https://infosec.exchange/@wdormann/117475540081194496
@GossiTheDog Link to the post from which the screenshot seems to have been taken:
https://news.ycombinator.com/item?id=50167754
I've seen claims that the post was deleted - but I can still see it.
-
-
@filid @GossiTheDog According to Heise, changing this parameter won't help https://www.heise.de/news/Wichtige-PHP-Updates-am-21-Oktober-beheben-Codeeinschleusung-Schwachstellen-11495072.html
@gunchleoc @GossiTheDog
Thanks, I updated my blog post mentioning heise and https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/ -
Somebody has posted technical details of the PHP vulns. It’s likely LLM generated from GitHub commits (or somewhere!) but it’s in the right ballpark on one of the issues.
There’s also another decent mitigation in this but the only real one is to patch.
-
@GossiTheDog so concern is that anyone sitting on vulns will now rush to exploit before they can be patched?
Seems like this kind of thing could also be used without real vulnerabilities (but with a bunch of honeypots in place) to "shake the bushes" for any vulns that are being held.
@fencepost @GossiTheDog I don’t know that there’s a need to rush. So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one.
-
@lanodan @GossiTheDog They didn’t.
-
@GossiTheDog @christopherkunz It's AI slop, so nobody should rely onthe proposed mitigation.
-
@GossiTheDog @systemadminihater @wdormann Plus the exploit is in the wild ...
-
A really good mitigation for this btw - AppArmor or SELinux.
Google something like apparmor restrict php from executing commands. Works against these CVEs.
Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.
What makes you think that Apparmor works against these?
-
I think PHP probably has to bring forward the release as cyber vendors who have advanced notice told customers details so now everybody is running around with details.
There’s probably a conversation to be had about cyber vendors effectively reselling open-source project intelligence for profit. I don’t think it is great. Protecting the ivory tower sucks.
@GossiTheDog You're faster than most commercial services on the issues that matter
.
