here's some info about the giant php bug dropping tomorrow:
https://www.openwall.com/lists/oss-security/2026/10/20/34
hopefully mastodon doesnt absolutely destroy the video quality, but it appears to be unauth php rce.
which means every firewall on the planet thats not patched thats just php under the hood and has its management interfaces exposed is potentially a target
it wont let me attach videos and stills at the same time.
yeah this is like java rhino all over again, except in reverse. instead of:
- user goes to site
- java applet runs and executes arbitrary code
its
- malware hits site with unauth rce against php
- site runs command
if you have publicly exposed shit thats running php, maybe um.
take it offline for tomorrow.
if you have business people who say its fine to have management interfaces publicly exposed to the internet, where its some appliance that runs php - show them the video.
if they still say its fine
call in sick tomorrow
oh, and youre welcome - i fetched that video via a proxy from the nazi site, saving you having to click through to the nazi site
NEWS!
someone leaked the bug, and the mitigation is a one-liner in php.ini:
session.upload_progress.enabled = Off
so maybe a bit less of an apocalypse
[EDIT: a core php dev has said this is insufficient. the apocalypse is back on!]
https://www.youtube.com/watch?v=HpkecYVRt_E
oh.
they knew the whole time
and they goosed the models
https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
@Viss I know which nazi site it is, but it's funny how it could actually be several different sites, without context.
Oct 21, 2026, 3:16 AM@Viss shows how out of date I am, I didn't know php5 had that feature. Apparently it was added in 5.4
@Viss If it's the same as https://infosec.exchange/@hdm/117476672019753101 it says there's a second one with "any multipart/form-data POST" which you have to mitigate with a WAF since that setting doesn't affect it. Feels LLM-generated, don't know how much of it is true.
@Viss let’s hope so!
@scottwilson just four seconds too late :D
Oct 21, 2026, 11:54 PM@Viss sadly no.
@kauer and it has gotten significantly dumber since that post
@Viss It's a constant surprise how much of our IT infrastructure is the equivalent of leaving our front door wide open with a cardboard sign that says "These are my things, please don't steal."
And then we wonder why our house is suddenly full of teenagers doing stupid crap.
@madengineering this is what happens when we let the business people who have no idea how computers work keep making the decisions about how computers should work
@Viss Thanks for the heads up. Added a "Require ip" tag to my Nextcloud site config until I verify the update has been applied. I would just leave it locked down, but I do use it to share family photo albums with relatives and such, since I don't have a Facebook, so it is a valuable service that we use online.
@Viss did I miss something?
@Viss All of my instances that use PHP are do old they are not affected. ( Tgey at have other issues, but I have isolated and remediated those myself.)
Oct 20, 2026, 11:15 PM@Viss If the floor for exploitation is low, I can't wait for this to be the next PHP vuln like Remote File Inclusion that gets throw for fucking DECADES and ends up resulting in a metric fuckton of new botnets.
@da_667 think of how much shit out there is running embedded dipshittery with unpatchable php that this will exploit forever
@da_667 think of every docker container and k8s container thats been running for 3-5 years thats never ever gonna get patched
Oct 20, 2026, 11:17 PM@Viss "just remove it and re-download it". Doesn't matter if the container image doesn't ever get updated. Have fun w/that.
@da_667 good luck have fun dont die! :D
Oct 21, 2026, 12:00 AM
@Viss I know I'm asking the wrong question at the worst time, but... What is that BGM?
@nazokiyoubinbou zero clue
@Viss Ah, ok, thanks anyway.
@nazokiyoubinbou i guess you could upload the video to youtube and see who hits you with a takedown notice :D - or alternatively there are probably shazam clones. i bet you could hand it to any llm out there now and ask it to tell you what song it is
@Viss I think I'm not that curious. 😆
@Viss Who was the original poster? I have found a link to the video file on infosec.exchange but i can't find the original post.
@LED2000 it was on twitter
Oct 21, 2026, 5:07 AMHow long until Ubuntu and Debian release patched packages? (rhetorical. I don't expect an answer.) Because that's the way a lot of people get their PHP packages.
@bruce the php folks say tomorrow, 7am pst
Oct 21, 2026, 8:50 AMThat's when PHP will provide a fix, but how long until the major distros update their packages? I hope not long, but who knows.
@Viss
Ofc it's an unauth RCE - otherwise you won't reach a score of 10.0 🥸
@Viss thoughts and prayers 🙏
@kcarruthers yeah shits going down tomorrow soon as that patch for php comes out. everyones gonna patchdiff, build the bug, and hose the entire internet down
