#php

If you're running #Nextcloud or any other PHP application, whether in containers or natively, update your PHP installations!

Especially if you're using Apache with mod_php, which is considered the highest-risk configuration for #PHP2Shell.

The #Debian Security Team has already released PHP 8.4.27-1~deb13u1 for #Trixie.

Happy host and container patching :)

#PHP #homelab #sysadmin #security

You know things get serious when even the german Tagesschau publishes news on the subject:

https://www.tagesschau.de/wirtschaft/technologie/it-sicherheit-php-luecke-100.html

Meanwhile, the PHP Group published the fixes:
https://github.com/php/php-src/releases/tag/php-8.5.12

#PHP #PHP2Shell #InfoSec #SysAdmin #OpenSource #SelfHosted

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
#php #security

> ls /nix/store/*-php*
ls: cannot access '/nix/store/*-php*': No such file or directory

Luckily I don't seem to run anything even remotely related to #PHP, so I apparently dodged that bullet. 😌

#nixos

Whoever decided "a watched pot never boils" was the saying, has clearly never waited for PHP build to complete.

#PHP

Unfortunately updated PHP packages for Debian Bookworm have been announced, but they are still missing on the mirrors:
https://security.debian.org/debian-security/pool/updates/main/p/php8.2/?C=M;O=D

#debian #bookworm #php

And a CA is also falling apart...

#php #php2shell #ca

🚨 PHP2Shell: Two critical RCE vulnerabilities. Emergency patches released.

CVE-2026-109618 and CVE-2026-109619 are rated CVSS 9.2/10 (CVSS v4.0) and can allow unauthenticated remote code execution against vulnerable PHP installations. The flaws affect PHP's core runtime, not just a particular CMS or plugin.

🔧 Fixed PHP releases:
• PHP 8.5 → 8.5.12
• PHP 8.4 → 8.4.27
• PHP 8.3 → 8.3.36
• PHP 8.2 → 8.2.35

⚠️ Running PHP 8.1 or older? These branches no longer receive regular upstream security updates. PHP has also provided minimal source-level backports for PHP 8.1, 8.0 and 7.4. Check your distribution or hosting provider for patched packages. Otherwise, upgrade to a supported branch, PHP 8.2 or later.

📊 Our analysis of over 7 million PHP websites found that 46.1% of sites disclosing their PHP version run an End-of-Life branch.

This is a serious exposure problem. Updating WordPress, Laravel or another application alone will not fix a vulnerability in the PHP runtime.

✅ Update PHP immediately.
✅ Verify the actual runtime used by PHP-FPM, Apache, CGI or your hosting environment.
✅ Check vendor advisories if your system uses backported security patches.

The PHP security team says there are no complete mitigations. Updating is the only safe choice.

Full technical analysis, vulnerability details and remediation:
https://thecybersecguru.com/advisory/php2shell-cve-2026-109618-109619-php-rce/

#InfoSec #CyberSecurity #PHP #RCE #CVE

PHP fixes two critical PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing remote code execution. Update to 8.5.12 or 8.4.27.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ModPHP #PatchNow #CyberSecurity

https://securityonline.info/php-rce-vulnerabilities-cve-2026-109618-109619/?utm_source=mastodon&utm_medium=jetpack_social

📣 Announcing the immediate availability of:

- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12

‼️ These address the following critical security issues:

- Remote Code Execution via Out of Memory corruption (CVE-2026-109618)
- Remote Code Execution via Stale Global State (CVE-2026-109619)

📝 https://www.php.net/ChangeLog-8.php
🎁 https://www.php.net/downloads?source=Y
:windows8: Windows: https://www.php.net/downloads.php?os=windows

Read more: https://www.php.net/archive/2026.php#2026-10-21-5

#PHP #Release #Security #CVE

One of the great things about unemployment is that I now don't have to fix #PHP installations that were chosen by the idiots I work for.

Going to be a fun day patching servers #php #php2shell

The #PHP CVE and #eMudhra's private key "4" be coming on the same day.

Absolute banger cybersecurity crisis.

I shut off the port forwarding to my #Nextcloud service until those #PHP patches are published by #Debian

Luckily, we can live without it for the day.

5 minutes until patch time.

Wishing all the caffeine and smooth deployment processes to everyone out there.

#PHP #HugOps

#PHP security advisories with technical details:

https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Website tot test whether your web server is vulnerable to PHP2Shell:

https://php2shell.aikido.io/

#PHP #PHP2Shell #Akido

legoktm.com is back up and patched

$ php -v
PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.27, Copyright (c) Zend Technologies
with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies

Thank you #Debian and #PHP!

Deploying #PHP updates to all systems with #Ansible...

#PHP vulnerability announcement (and exploit details) out - https://www.php.net/archive/2026.php#2026-10-21-5

I'm guessing a lot of vendors will release their patched software at 14:00 UTC when the announcement was originally expected.

The patch is out
https://www.php.net/archive/2026.php

#php

If anyone is using #Nextcloud through Hetzner's Storage Share, they're planning to patch #PHP once security release is out. Check your email.

#opensource #php2shell

CVE-2026-114403: PHPOffice PHPPresentation ≤1.2.0 faces CRITICAL insecure deserialization (CVSS 9.2). Remote code execution & DoS possible via crafted uploads. No patch; avoid untrusted inputs. Details: https://radar.offseq.com/threat/cve-2026-114403-deserialization-of-untrusted-data-in-phpoffice-phppresentation-21b2eb9e24a6b900 #OffSeq #CVE2026114403 #PHP #AppSec

I have a customer with a site still running php4.4.4.

The lucky bastard!

#php #php2shell

How to apply security updates for PHP and ensure they are being used? #updates #php #security

https://askubuntu.com/q/1570480/612

T-47 minutes until 💩storm hits.

#php

Disabling any request body processing with #Vinyl_Cache to avoid the #php RCE is simple:

sub vcl_recv {
if (req.http.Content-Length || req.http.Transfer-Encoding) {
return (synth(403, "No req body"));
}
}

Happy PHP Wednesday.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.

https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

#php #vulnerability #patchmanagement #infosec #incidentresponse

Trying to access a #Wordpress installation on #Ionos shared hosting right now is something else. Timeouts left, right and center, probably because every one else on the same machine is desperately trying to backup before 2PM UTC or something... :D

#php #php2shell

I don't think this #PHP issue is related, though I might be wrong. The main issue here seems to be that there are loads of apps using older versions of PHP, which won't be patched because they've passed end of life. And remote code execution is a pretty bad vulnerability.

https://mastodon.xyz/@nextcloud/117478725232757164