<div dir="ltr"><div><br clear="all"></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">-- </div><div dir="ltr"><span style="font-size:12.8px">Royce</span><br></div></div></div></div></div></div></div><br><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <strong class="gmail_sendername" dir="auto">Royce Williams</strong> <span dir="auto"><<a href="mailto:royce@tycho.org">royce@tycho.org</a>></span><br>Date: Wed, Oct 21, 2026 at 5:57 AM<br>Subject: Re: [nuga] upcoming PHP vulns CVE-2026-109618, CVE-2026-109619<br>To: <<a href="mailto:nuga@groups.io">nuga@groups.io</a>><br></div><br><br><div dir="ltr"><div><a href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" target="_blank">https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w</a></div><div><span style="background-color:transparent"><a href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" target="_blank">https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp</a></span></div><div><br></div><div>php-src (PHP)<br>Affected versions<br>< 8.2.35<br>< 8.3.36<br>< 8.4.27<br>< 8.5.12<br>Patched versions<br>8.2.35<br>8.3.36<br>8.4.27<br>8.5.12</div><div><br></div><div><a href="https://infosec.exchange/@wdormann/117479190363340291" target="_blank">https://infosec.exchange/@wdormann/117479190363340291</a></div><div><br></div><div><br></div><div><p style="font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-stretch:inherit;font-size:15px;line-height:inherit;font-family:mastodon-font-sans-serif,sans-serif;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px 0px 20px;padding:0px;white-space:pre-wrap;unicode-bidi:plaintext;color:rgb(238,237,243);background-color:rgb(24,24,32)">Update your PHP (if you can), folks. That is, install PHP 8.5.12 to fix critical vulnerabilities <a rel="noopener" href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" title="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" style="font:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;color:rgb(165,171,253);text-decoration:rgb(165,171,253);unicode-bidi:isolate" target="_blank">CVE-2026-109618 <span style="font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;font-size:0.8em;line-height:inherit;font-family:inherit;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;color:rgb(255,185,0)">[github.com]</span></a> and <a rel="noopener" href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" title="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" style="font:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;color:rgb(165,171,253);text-decoration:rgb(165,171,253);unicode-bidi:isolate" target="_blank">CVE-2026-109619 <span style="font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;font-size:0.8em;line-height:inherit;font-family:inherit;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;color:rgb(255,185,0)">[github.com]</span></a>.<br><a rel="noopener" href="https://www.php.net/archive/2026.php#2026-10-21-5" title="https://www.php.net/archive/2026.php#2026-10-21-5" style="font:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;color:rgb(165,171,253);text-decoration:rgb(165,171,253);unicode-bidi:isolate" target="_blank"><span style="font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;font-size:0px;line-height:0;font-family:inherit;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;width:0px;height:0px;display:inline-block">https://www.</span><span style="font:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px">php.net/archive/2026.php#2026-</span><span style="font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;font-size:0px;line-height:0;font-family:inherit;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;width:0px;height:0px;display:inline-block">10-21-5</span></a></p><p style="font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-stretch:inherit;font-size:15px;line-height:inherit;font-family:mastodon-font-sans-serif,sans-serif;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px 0px 20px;padding:0px;white-space:pre-wrap;unicode-bidi:plaintext;color:rgb(238,237,243);background-color:rgb(24,24,32)">Until updates are available on your platform, I hear that setting in php.ini</p><pre style="font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-stretch:inherit;font-size:15px;line-height:inherit;font-family:inherit;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px 0px 22px;padding:8px;white-space:pre-wrap;unicode-bidi:plaintext;background:none 0% 0%/auto repeat scroll padding-box border-box rgb(87,24,60);color:rgb(255,175,212);border-radius:4px"><code style="font-style:inherit;font-variant:inherit;font-stretch:inherit;font-size:0.85em;line-height:inherit;font-family:mastodon-font-monospace,monospace;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;background:0px 0px;border-radius:4px">memory_limit=-1<br>session.upload_progress.enabled=0<br>fatal_error_backtraces=0<br></code></pre><p style="font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-stretch:inherit;font-size:15px;line-height:inherit;font-family:mastodon-font-sans-serif,sans-serif;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px 0px 20px;padding:0px;white-space:pre-wrap;unicode-bidi:plaintext;color:rgb(238,237,243);background-color:rgb(24,24,32)">can mitigate some attacks. Also:</p><blockquote style="font-variant-numeric:inherit;font-variant-east-asian:inherit;font-variant-alternates:inherit;font-stretch:inherit;font-size:15px;line-height:inherit;font-family:mastodon-font-sans-serif,sans-serif;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;quotes:none;unicode-bidi:plaintext;color:rgb(255,175,212);background-color:rgb(24,24,32)"><p style="font:inherit;vertical-align:baseline;border:0px;margin:0px;padding:0px;white-space:pre-wrap;unicode-bidi:plaintext">Set a low <code style="font-style:inherit;font-variant:inherit;font-stretch:inherit;font-size:0.85em;line-height:inherit;font-family:mastodon-font-monospace,monospace;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:4px;background:none 0% 0%/auto repeat scroll padding-box border-box rgb(87,24,60);border-radius:4px">post_max_size</code>. For applications that don't require file uploads, set <code style="font-style:inherit;font-variant:inherit;font-stretch:inherit;font-size:0.85em;line-height:inherit;font-family:mastodon-font-monospace,monospace;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:4px;background:none 0% 0%/auto repeat scroll padding-box border-box rgb(87,24,60);border-radius:4px">post_max_size = 8M</code>. If file uploads are necessary, set <code style="font-style:inherit;font-variant:inherit;font-stretch:inherit;font-size:0.85em;line-height:inherit;font-family:mastodon-font-monospace,monospace;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:4px;background:none 0% 0%/auto repeat scroll padding-box border-box rgb(87,24,60);border-radius:4px">post_max_size = 32M</code>. Keep <code style="font-style:inherit;font-variant:inherit;font-stretch:inherit;font-size:0.85em;line-height:inherit;font-family:mastodon-font-monospace,monospace;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:4px;background:none 0% 0%/auto repeat scroll padding-box border-box rgb(87,24,60);border-radius:4px">upload_max_filesize</code> below <code style="font-style:inherit;font-variant:inherit;font-stretch:inherit;font-size:0.85em;line-height:inherit;font-family:mastodon-font-monospace,monospace;font-size-adjust:inherit;font-kerning:inherit;font-feature-settings:inherit;vertical-align:baseline;border:0px;margin:0px;padding:4px;background:none 0% 0%/auto repeat scroll padding-box border-box rgb(87,24,60);border-radius:4px">post_max_size</code>. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.</p></blockquote></div><div><br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">-- </div><div dir="ltr"><span style="font-size:12.8px">Royce</span><br></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Oct 21, 2026 at 5:31 AM Royce Williams via <a href="http://groups.io" target="_blank">groups.io</a> <royce.williams=<a href="mailto:gmail.com@groups.io" target="_blank">gmail.com@groups.io</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div>Cloudflare has WAF rules that are reported to cover this (and they are likely in the group of orgs who have official advance warning). Even their free tier is covered.</div><div><br></div><div>So putting your asset behind Cloudflare -- fast -- could be a reasonable mitigation.</div><div><br clear="all"></div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div>-- </div><div>Royce</div></div></div></div><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <strong class="gmail_sendername" dir="auto">Royce Williams</strong> <span dir="auto"><<a href="mailto:royce@tycho.org" target="_blank">royce@tycho.org</a>></span><br>Date: Wed, Oct 21, 2026 at 5:23 AM<br>Subject: upcoming PHP vulns CVE-2026-109618, CVE-2026-109619<br>To: <<a href="mailto:nuga@groups.io" target="_blank">nuga@groups.io</a>>, AKLUG <<a href="mailto:aklug@aklug.org" target="_blank">aklug@aklug.org</a>><br></div><br><br><div dir="ltr"><div>POCs have been leaked prior to official announcement. May be prudent to disable PHP until patches can be applied. Exploit rumored trivial, likely large filename in specific kind of upload. Only PHP 8.x will be patched (so far). Announcement scheduled for 6:00 AM Alaska time.</div><div><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><br></div><div dir="ltr"><a href="https://isc.sans.edu/diary/Critical%20PHP%20Vulnerability%20%28CVE-2026-109618%2C%20CVE-2026-109619%29%20%5Binfocon%20yellow%5D/33440" target="_blank">https://isc.sans.edu/diary/Critical%20PHP%20Vulnerability%20%28CVE-2026-109618%2C%20CVE-2026-109619%29%20%5Binfocon%20yellow%5D/33440</a></div><div dir="ltr"><br></div><div dir="ltr">-- </div><div dir="ltr"><span style="font-size:12.8px;background-color:transparent">Royce</span></div></div></div></div></div></div></div></div>
</div></div>
</div>
<div width="1" style="color:white;clear:both">_._,_._,_</div>
<hr>
Groups.io Links:<p>
You receive all messages sent to this group.
</p><p>
<a href="https://groups.io/g/nuga/message/593" target="_blank">View/Reply Online (#593)</a> |
<a href="mailto:nuga@groups.io?subject=Re:%20%5Bnuga%5D%20upcoming%20PHP%20vulns%20CVE-2026-109618%2C%20CVE-2026-109619" target="_blank">Reply to Group</a>
| <a href="mailto:royce.williams@gmail.com?subject=Private:%20Re:%20%5Bnuga%5D%20upcoming%20PHP%20vulns%20CVE-2026-109618%2C%20CVE-2026-109619" target="_blank">Reply to Sender</a>
|
<a href="https://groups.io/mt/121866513/548220" target="_blank">Mute This Topic</a>
| <a href="https://groups.io/g/nuga/post" target="_blank">New Topic</a>
<br>
<a href="https://groups.io/g/nuga/editsub/548220" target="_blank">Your Subscription</a> |
<a href="mailto:nuga+owner@groups.io" target="_blank">Contact Group Owner</a> |
<a href="https://groups.io/g/nuga/leave/1150102/548220/107963826/xyzzy" target="_blank">Unsubscribe</a>
[<a href="mailto:royce.williams@gmail.com" target="_blank">royce.williams@gmail.com</a>]<br>
</p><div width="1" style="color:white;clear:both">_._,_._,_</div>
<p></p><p></p></blockquote></div>
</div></div>