[aklug] Fwd: [nuga] upcoming PHP vulns CVE-2026-109618, CVE-2026-109619

[Royce Williams]

-- 
Royce


---------- Forwarded message ---------
From: Royce Williams <royce at tycho.org>
Date: Wed, Oct 21, 2026 at 5:57 AM
Subject: Re: [nuga] upcoming PHP vulns CVE-2026-109618, CVE-2026-109619
To: <nuga at groups.io>


https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

php-src (PHP)
Affected versions
< 8.2.35
< 8.3.36
< 8.4.27
< 8.5.12
Patched versions
8.2.35
8.3.36
8.4.27
8.5.12

https://infosec.exchange/@wdormann/117479190363340291


Update your PHP (if you can), folks. That is, install PHP 8.5.12 to fix
critical vulnerabilities CVE-2026-109618 [github.com]
<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>
and CVE-2026-109619 [github.com]
<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>.
https://www.php.net/archive/2026.php#2026-10-21-5

Until updates are available on your platform, I hear that setting in php.ini

memory_limit=-1
session.upload_progress.enabled=0
fatal_error_backtraces=0

can mitigate some attacks. Also:

Set a low post_max_size. For applications that don't require file uploads,
set post_max_size = 8M. If file uploads are necessary, set post_max_size =
32M. Keep upload_max_filesize below post_max_size. Consider enforcing
limits at the web server or proxy level for decoded request size, input
field count, multipart part count, header count, and nesting depth. These
limits must also cover requests without a usable Content-Length.


-- 
Royce


On Wed, Oct 21, 2026 at 5:31 AM Royce Williams via groups.io
<royce.williams=gmail.com at groups.io> wrote:

> Cloudflare has WAF rules that are reported to cover this (and they are
> likely in the group of orgs who have official advance warning). Even their
> free tier is covered.
>
> So putting your asset behind Cloudflare -- fast -- could be a reasonable
> mitigation.
>
> --
> Royce
>
>
> ---------- Forwarded message ---------
> From: Royce Williams <royce at tycho.org>
> Date: Wed, Oct 21, 2026 at 5:23 AM
> Subject: upcoming PHP vulns CVE-2026-109618, CVE-2026-109619
> To: <nuga at groups.io>, AKLUG <aklug at aklug.org>
>
>
> POCs have been leaked prior to official announcement. May be prudent to
> disable PHP until patches can be applied. Exploit rumored trivial, likely
> large filename in specific kind of upload. Only PHP 8.x will be patched (so
> far). Announcement scheduled for 6:00 AM Alaska time.
>
>
> https://isc.sans.edu/diary/Critical%20PHP%20Vulnerability%20%28CVE-2026-109618%2C%20CVE-2026-109619%29%20%5Binfocon%20yellow%5D/33440
>
> --
> Royce
> _._,_._,_
> ------------------------------
> Groups.io Links:
>
> You receive all messages sent to this group.
>
> View/Reply Online (#593) <https://groups.io/g/nuga/message/593> | Reply
> to Group
> <nuga at groups.io?subject=Re:%20%5Bnuga%5D%20upcoming%20PHP%20vulns%20CVE-2026-109618%2C%20CVE-2026-109619>
> | Reply to Sender
> <royce.williams at gmail.com?subject=Private:%20Re:%20%5Bnuga%5D%20upcoming%20PHP%20vulns%20CVE-2026-109618%2C%20CVE-2026-109619>
> | Mute This Topic <https://groups.io/mt/121866513/548220> | New Topic
> <https://groups.io/g/nuga/post>
> Your Subscription <https://groups.io/g/nuga/editsub/548220> | Contact
> Group Owner <nuga+owner at groups.io> | Unsubscribe
> <https://groups.io/g/nuga/leave/1150102/548220/107963826/xyzzy> [
> royce.williams at gmail.com]
> _._,_._,_
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.aklug.org/pipermail/aklug/attachments/20261021/e81be086/attachment-0001.htm>