#php2shell

Steal my #Bitcoin There is a bitcoin key hidden on this server worth about $2,014. It is accessible to the PHP user account through the print-flag binary. This #PHP version was selected from before the #PHP2SHELL CVEs were released. https://stealmybitcoin.com/ EDIT: Just wanted to clarify that this is not my initiative and I’m not affiliated with it. Sorry if my original post suggested otherwise, it was a quick copy/paste from the website (which seems to be down since several hours, by the way). I simply saw the link and I liked the idea.

#php2shell is based on PHP using longjmp(3) to bail out of OOM conditions. They fixed that by actually properly unwinding the call stack under those conditions -- that's the "replace bailout with UnwindExit" part in the massive diff that touches 389 files here: https://github.com/php/php-src/commit/01a40e89fb Cool. But. There are still dozens of other places where PHP longjmp(3)'s, and frankly, I don't think that can possibly be a safe error handling approach in a long-lived, server-side process.

Has anyone seen (and confirmed) a solid #PHP2Shell proof-of-concept? GitHub is awash in slop.

Affected by PHP2Shell (CVE-2026-109618/CVE-2026-109619)? Freexian’s PHP LTS provides updates for PHP 5.6 and later on Debian 9+ and Ubuntu 18.04+. Explore our plans at https://www.freexian.com/lts/php/?utm_source=mastodon&utm_medium=social or get in touch to discuss your options. #php2shell #php #freexian

thank you @dansup + @pixelfed -Team for navigating through #php2shell!

So one option in #Vinyl_Cache is to check if you have any such requests: vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form' vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form' The first command scans the in-memory log, the second runs until interrupted on live data. If you do not see multipart/form-data requests, you can simply refuse them in VCL. #php2shell

Another very simple option in #Vinyl_Cache is to limit the size of request bodies using std.cache_req_body(). This also has the added benefit that chunked transfer encoding is tuned into a request with a content-length, such that php can check it upfront against the maximum body size. In the example, the maximum size should be adjusted accordingly. #php2shell

New short article: How #Vinyl_Cache can help with #php2shell

@nixCraft@mastodon.social Would like to, but still no packages for RHEL!? #RHEL #RHEL9 #php2shell

So today some of the worst people on earth using the most environmentally destructive tools on earth brought down a huge part of the internet by exploiting a potential problem found many years ago in PHP which was previously not practical for anyone to exploit. It only became "practical" to exploit this problem because "AI" came along to automate the boring and repetitive work required to do so. Absurd amounts of computing power were applied specifically to break into other peoples' websites. Now the same people who are behind this are trying to pretend that they're heroes for finding an exploit. "AI uncovers critical vulnerabilities", their headline reads. But the vulnerability was only made to be critical by the very same people as hide behind that headline. Many thousands of websites are offline, many people are losing money, many thousands of people are working hard to try to patch or work around the problem, many small guys are finding it almost impossible to patch, and we're all supposed to be thankful to OpenAI and others involved ? Nah. Fuck off. Everything about "AI" involves a lot of externalized costs, but I've still yet to see even a single positive thing that has been achieved by "AI". That has definitely not changed today. #php2shell #php #fuckai #openai

Les utilisateurices de Yunohost, c’est l’heure de mettre à jour le système! EDIT 2: une nouvelle faille PHP a été détectée. Je vous encourage à couper tous les services qui s’appelle php-quelquechose dans l’interface de Yunohost. Source: https://fedi.katze.sh/@elise/117479383739450605 PHP: https://forum.yunohost.org/t/cve-2026-109618-109619-critical-vulnerability-in-php-upgrade-system-package-asap/43206 SSL: https://forum.yunohost.org/t/compromised-certificate-authority-upgrade-system-package-and-your-devices-asap/43207/1 EDIT 1: pour savoir si vous êtes à jour au niveau de la faille SSL découverte cette nuit, vous pouvez utiliser les deux commandes dans la console SSH de votre serveur: curl https://dv-g3b-emudhra.we-have-a-problem.com/ curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ Si l’une d’elle affiche "hello", il vous reste des mises-à-jour à effectuer! #yunohost #php2shell #eMudhra #4

Lol. #php #php2shell

#PHP2Shell is now trending across Mastodon