PHP Vulnerability

[Ozone]

I've been reading that there is a critical warning (9.2 / 10) and its looking quite serious for web sites/servers etc running unpatched PHP.

CVE-2026-109618 and CVE-2026-109619

https://www.ncsc.gov.uk/news/critical-security-iss...

The patches appear to have only been released today. I'm out of the loop with this, but is anyone in the know or is this just the usual nothing to see here - carry on warnings?

[rxtx]

No, it's quite serious.

[Athlon]

MOT system is offline

[Ozone]

rxtx said:

No, it's quite serious.

Thanks. Just keeping an eye on my work web site - I'm not involved with it but just wondering if my office will be affected in the next few days.

[rxtx]

Ozone said:

Thanks. Just keeping an eye on my work web site - I'm not involved with it but just wondering if my office will be affected in the next few days.

Are they using PHP on something publicly accessible? I would have shut it down immediately and upgraded.

[bangerhoarder]

It’s huge, and is starting to be seen in the wild apparently.

I had our only server that uses it patched within a few minutes of the newest version going live - it was only 8.5.9 to 8.5.12 so no real work. Anyone sitting on an old, unsupported version of PHP will get a hell of a shock because there’s a lot of compatibility work to do, potentially.

[petemurphy]

What can attackers do with it in simple terms?

[Scabutz]

petemurphy said:

What can attackers do with it in simple terms?

Imagine your house is business, has lots of sensitive data stored in its cupboard and drawers, has access to other houses via a bunch of keys left on the sideboard. You've gone out and left all the windows and doors open

[Ozone]

rxtx said:

Are they using PHP on something publicly accessible? I would have shut it down immediately and upgraded.

Its managed and admin'd by an outside company who don't seem to be the fastest at resolving issues. I've used a browser in Dev mode to check for any PHP related instances and luckily seems to be OK but that's just a basic check.
Its not really my problem/in my remit but I'll be looking for work for my team to be getting on with if the web based platforms are affected...

Or we'll be down to playing Solitare on the workstations

[Yertis]

Scabutz said:

petemurphy said:

What can attackers do with it in simple terms?

Imagine your house is business, has lots of sensitive data stored in its cupboard and drawers, has access to other houses via a bunch of keys left on the sideboard. You've gone out and left all the windows and doors open

Isn't it the case that the window was always open, but nobody knew? Now somebody has spotted it so it's suddenly a problem. Correct me if I'm wrong.

[Scabutz]

Yertis said:

Scabutz said:

petemurphy said:

What can attackers do with it in simple terms?

Imagine your house is business, has lots of sensitive data stored in its cupboard and drawers, has access to other houses via a bunch of keys left on the sideboard. You've gone out and left all the windows and doors open

Isn't it the case that the window was always open, but nobody knew? Now somebody has spotted it so it's suddenly a problem. Correct me if I'm wrong.

Yeah. It's not been recently introduced, it was always there, but now a good actor has found it. There is no guarantee that someone bad out there has known about it for a whilw and been exploiting it. Announcing it lets the cat out the bag but everyone sees its a big enough issue it has to be surfaced to push people to update.

[bangerhoarder]

Ozone said:

Its managed and admin'd by an outside company who don't seem to be the fastest at resolving issues. I've used a browser in Dev mode to check for any PHP related instances and luckily seems to be OK but that's just a basic check.
Its not really my problem/in my remit but I'll be looking for work for my team to be getting on with if the web based platforms are affected...

Or we'll be down to playing Solitare on the workstations

You most likely won’t see anything unless the PHP version is exposed to you via the website (in the backend, usually). It runs on the server itself, so when a page is requested by a client it executes the code directly on the server. That’s why it’s so important to patch it.

[silentbrown]

It's big and serious. PHP powers a huge number of websites - all Wordpress sites, for example.

https://en.wikipedia.org/wiki/PHP#Popularity_and_u...

72% of all websites!

[Scabutz]

silentbrown said:

It's big and serious. PHP powers a huge number of websites - all Wordpress sites, for example.

https://en.wikipedia.org/wiki/PHP#Popularity_and_u...

72% of all websites!

Although its not lie WordPress hasn't had all its doors and windows open for years regardless of its underlying tech. Awful product. Nothing serious should be running WP though.

[ColinsCornflakes]

I woke up to this this morning....

https://www.huntress.com/blog/php2shell-leaked-cri...


As it turns out the sky hasn't fallen in.

Goodnight.

[MikeGTi]

[buggalugs]

Spent a few hours yesterday updating our web servers. I've seen reports that contrary to the headlines it's actually a hard exploit to... exploit and it may become a nothing burger but better safe than sorry.

[TheBinarySheep]

I have an old client I don’t do much for these days. Their organisation owns a server running a couple of PHP websites.

For at least the last 12 months, we’ve been telling them the CMS needs updating, and that it can’t be updated because the PHP version on the server is too old. Their in-house team are all Microsoft people, so Linux servers and PHP aren’t really their thing. I’ve offered more than once to sort it out for them, but it’s never been money they wanted to spend.

Then today, out of nowhere, I get a request to take the sites down. Their infosec team have finally noticed and are going absolutely nuts at them for letting it get this far. Minor detail: one of those sites is a significant source of income.

It gets better. While answering infosec’s questions, I had to break the news that it’s not just the CMS and PHP that are end of life. The server OS is too, and has been for about two and a half years.

All hell has broken loose. I’m just sitting here with popcorn and a draft quote to migrate everything to a new server.

[OIC]

Does PH use PHP?

Wouldn't like anyone fiddling with the wife's soiled undies while I'm out at work.

[buggalugs]

OIC said:

Does PH use PHP?

Wouldn't like anyone fiddling with the wife's soiled undies while I'm out at work.

PH is asp, as written by petrol ted, dunno how much of his handiwork is left though. I can't help with the soiled undies unfortunately.