Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
@GossiTheDog Any mitigations for Windows? We have customers running PHP 7 and even 5 who cannot patch (besides, there won't be a patch available for anything but 8).
Or should we just prepare for incident response?
-
@bontchev @GossiTheDog Any good ones?
-
@bontchev @GossiTheDog Any good ones?
@t_var_s @GossiTheDog Haven't tried any of the PoCs yet; need the admin's permission. The write-ups contain mitigations but warn that they are not completely sufficient. I've also seen claims that making the site read-only (i.e., disable POST requests) prevents the exploit, if you can afford to do it.
-
BSI advisory on PHP:
https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.html
And yes, I agree with everybody it is best to patch where updates are available.
There *are* mitigations for some of the chain which may be useful as an interim measure - they should be in the PHP advisory I’m guessing, if not I’ll do a blog later.
SELinux and AppArmor, configured correctly, work well and should be considered regardless.
PHP updates and mitigations are out: https://www.php.net/index.php#2026-10-21-5
-
The screenshot in this tweet is real. https://infosec.exchange/@wdormann/117475540081194496
@GossiTheDog I sent claude after it just using the source code and the picture posted. Got a PoC working by the time I dropped the kid off at school.
-
PHP updates and mitigations are out: https://www.php.net/index.php#2026-10-21-5
-
PHP updates and mitigations are out: https://www.php.net/index.php#2026-10-21-5
@GossiTheDog but where are the docker images?
-
PHP updates and mitigations are out: https://www.php.net/index.php#2026-10-21-5
@GossiTheDog is php 4 affected (asking for a friend)?
-
@GossiTheDog I sent claude after it just using the source code and the picture posted. Got a PoC working by the time I dropped the kid off at school.
@GossiTheDog Messing with getting a PoC. This doesn't seem to be a trivial exploit. ASLR has to be defeated through leak addresses, size of the memory has to be large enough, specific glibc has to be considered. While the entire platform of PHP is vulnerable, I don't think this is going to be a simple exploit to land.
-
@GossiTheDog is php 4 affected (asking for a friend)?
@CenturyAvocado @GossiTheDog Get with the times! (I'm on php 5)
-
@GossiTheDog Messing with getting a PoC. This doesn't seem to be a trivial exploit. ASLR has to be defeated through leak addresses, size of the memory has to be large enough, specific glibc has to be considered. While the entire platform of PHP is vulnerable, I don't think this is going to be a simple exploit to land.
-
@GossiTheDog More information, from various sources:
https://medium.com/@costin.raiu/php2shell-apocalypse-b8dae59dd753
https://cybersecuritynews.com/php-early-exploitation-attempts/
Exploitation attempts seem to have started, despite the lack of public weaponizable exploit.
-
The PHP situation will lead to a mass of incidents - it’s one of the biggest vulns in years.
Shodan dork "X-Powered-By: PHP/" - a lot are on EOL versions with no patch. It’s also more hosts as not everybody lists their PHP version in headers.
@GossiTheDog so glad I am retired from cyber security. Good luck, folks
-
@t_var_s @GossiTheDog One of the mitigations suggests disabling that.
-
@GossiTheDog @CenturyAvocado do the patches actually fix it as I'm seeing rumors that maybe not or another similar exploit
-
@GossiTheDog @CenturyAvocado urrgh
-
@GossiTheDog More information, from various sources:
https://medium.com/@costin.raiu/php2shell-apocalypse-b8dae59dd753
https://cybersecuritynews.com/php-early-exploitation-attempts/
Exploitation attempts seem to have started, despite the lack of public weaponizable exploit.
@GossiTheDog And even more. (Serious stuff starts after the comic at the beginning.):
-
@GossiTheDog yeah, I'm calling bs on this too. From a place of "having tried the poc", see e-mail for details.
https://chaos.social/@christopherkunz/117477368766737839@christopherkunz @GossiTheDog What if this was just some readiness test from counter-intelligence? Tomorrow is told there was no exploit. Only hundred thousand servers rummaging through launchpad for software updates.
-
PHP releasing patches tomorrow for CVE-2026-109618 and CVE-2026-109619
Fixed versions will be 8.5.12, 8.4.27, 8.3.36, 8.2.35
All others are end-of-life but are still vulnerable - the vulns date back to versions from 2004 onwards.
@GossiTheDog According to the post below, 8.5.12 introduced a new vulnerability
https://fedi.katze.sh/@elise/117479383739450605
(edit: no, different vuln, I missed the details earlier in their thread)
