Somebody has leaked CVE-2026-109618 and CVE-2026-109619 in PHP before the patch is out.
-
Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
@GossiTheDog crap
-
@8tpercent @GossiTheDog does anyone know if Asustor or QNAP login portals use unpatched PHP versions? They seem to only mention PHP installations on the NAS, not the portals themselves (Synology explains that theirs doesn't), and if I'm not wrong, their remote connection capabilities mean someone could access them remotely without the manager/owner knowing at all.
-
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/@GossiTheDog Presumably that may get confused by backports, i know some hosting control panel providers have backported to 7.4 for instance.
-
@GossiTheDog Presumably that may get confused by backports, i know some hosting control panel providers have backported to 7.4 for instance.
@GossiTheDog I guess it depends if the backport changes the reported version.
-
ASLR supporting PHP exploits are coming, probably next week.. but it’s a really good security control (from decades ago) you should demand your vendors actually enable as it enabled time for orgs paying attention to patch.
The cybersecurity vendor industry itself is essentially negligent when it comes to this stuff. https://infosec.exchange/@catc0n/117487878549556020
There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic.
It is a non-default configuration and will not be a widespread issue.
The mitigations in this thread already fix it, if you want to panic.
-
There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic.
It is a non-default configuration and will not be a widespread issue.
The mitigations in this thread already fix it, if you want to panic.
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
-
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
That's really Matt Mullenweg's decision. I'm not holding my breath.
-
@GossiTheDog here's where I'd install the patch
@GossiTheDog ok there is now an ETA of 26-30 Oct depending on version
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
So what Meta (who famously [edit: used to] use PHP extensively in what used to be their flagship product) spent on the complete failure that was the metaverse (~$60 billion) could have funded them at current levels for close to 100,000 years
-
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
@GossiTheDog This argument has always been dumb as rocks.
Nobody @ me about entropy. This vulnerability, however severe, backed by more computing power than all non-AI technology combined, still hasn’t been exploited in one of the largest attack surfaces in the world, in all but perfect conditions with config parity.
The downsides of ALSR are tiny, and small bus messaging with large addresses spaces on the very, very fast hardware we have these days make it a no brainer to have enabled along with DEP and memory isolation if available to you.
Core pinning and isolation in conjunction with these mean all but the most dedicated attacks fail at the first hurdle. And I haven’t seen a single successful attack on systems with those in place.
They’re nearly impact-free and built in. I’d argue modern hardware should enforce this by default.
People literally balking at defence in depth measures because they can be defeated.
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog
Sure, but they knew about this since 2024!
So the main issue still is bad judgment on security here, as they invested their time and money obviously on other issues since then… -
@GossiTheDog
Sure, but they knew about this since 2024!
So the main issue still is bad judgment on security here, as they invested their time and money obviously on other issues since then…@MarkusStoll I hate to alarm you but there are likely other known, bigger issues. They need funding.
-
@MarkusStoll I hate to alarm you but there are likely other known, bigger issues. They need funding.
@GossiTheDog
I strongly doubt that there was a bigger issue than this, as this makes it very clear to everyone that you should avoid using PHP.
Still I concur, that whoever uses it, should contribute to this… -
OpenAI ambulance chasing the PHP vulnerabilities and pretending they found and disclosed them (they did not) is disgusting. It’s a media play and it’s really gross, and says a lot about OpenAI.
@GossiTheDog If OpenAI are claiming responsibility, ie admitting guilt, does that mean they're going to pay the costs?
-
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog Only an iota of humanity Please save my life by opening the link and seeing my story. Help me with one dollar or share
https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live -
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
@GossiTheDog and to be honest they're not the worst ones. At least they do have a budget, and core developers on the payroll. And many thanks to the @sovtechfund for that audit financing in 2024!
-
@GossiTheDog but yeah, php is a bad language and we should get rid of it.
@f4grx @GossiTheDog it's also totally irrelevant whether it's good or bad (and what about C, C++ or anything else), you don't just "get rid of it" in the real world.
