Post

details leaked. this vulnerability is a full unauthenticated unconditional remote code execution exploit against any service running on a PHP version from 5.4 until latest yeah if anything deserves CVSS 11, this is it. this is CATACLYSMICALLY bad.

if you are running a PHP application - it does not matter what it is - you are vulnerable. if you are running some embedded firmware that uses PHP to serve its web UI - you are vulnerable. full details and a patch at 2 PM UTC sharp tomorrow, you have been advised to prepare to patch immediately

i have managed to break the thread so reposting this: ONLY CURRENTLY IN-LIFE VERSIONS WILL RECEIVE FIRST-PARTY PATCHES. NO EOL VERSIONS WILL BE PATCHED. countdown til patches: time.is/countdown/14... cyberplace.social/@GossiTheDog...

If I interpret this (coming from a core Debian PHP maintainer) correctly, Debian/Ubuntu packages might be a little bit late: Ondrej Sury: "I don't think that my builder will be able to build everything on time." codeberg.org/oerdnj/deb.s... via layer8.space/@sebastianla...

oh dear

Quick Question: How does one determine if they are running a PHP application or are on a PHP serving website? Is it possible to disable PHP interaction on a device?

this is not your problem, this is the website operator's problem: bsky.app/profile/nigh...

we are seeing web proxy vendors (such as @cloudflare.social and @bunny.net) beginning to implement WAF rules to prevent in-the-wild exploitation of critical PHP bugs. THIS DOES NOT DEFINITIVELY LINK THESE CASES TO THE CVE NUMBERS. WE WILL NOT KNOW UNTIL THE PATCHES LAND. bunny.net/blog/cve-202...

UPDATE: UH FUCKING OH, CVE-2026-109619 HAS BEEN SEEMINGLY LEAKED AHEAD OF PATCH TIME...????? github.com/php/php-src/...