Post by @wdormann@infosec.exchange

2026-10-21 16:55 UTC

If we look at the Red Hat advisories for CVE-2026-109619 and CVE-2026-109619, we can see that the "Errata" and "Release Date" columns are empty. Which suggests that no fixes are available. But if we look at one of the affected products (RHEL9, php8.3), we can see that there is indeed an update available: RHSA-2026:87079 This sort of stuff makes me glad I'm not responsible for sysadmin stuff in the real world.

Replies (1)

@wdormann@infosec.exchange 2026-10-22 19:29

In the ever-growing sea of AI slop exploits out there, this is the closest I've seen to being viable: https://github.com/9bie/php2shell-bypass-aslr-exp With two large caveats: 1) It requires specific, albeit plausible, configuration options for PHP. 2) It appears to requires specific knowledge of the specific PHP code running on the target system. With these two caveats, yeah, you can get code execution. Without them, good luck? At least with what I've seen so far, I've not seen any evidence that there's a universal exploit for this. It's possible that this vulnerability may be able to be combined with another vulnerability in a popular platform to achieve universal reliably. But I don't think we're even there yet.

Open ##5256393