PSA: #php2shell gives attackers remote code execution on php servers pre-authentication, and @fastly.com has seen active attack activity.

Here is what you need to know:

* Two critical PHP vulnerabilities disclosed today (CVE-2026-109618, CVE-2026-109619, CVSS 9.2 

* The root is a decades-old design choice in PHP's error handling (described more in our post)

* There was evidence of in-the-wild exploitation pre-disclosure. 

The potential impact cannot be overstated:
* Breadth: Any organization with PHP applications
* Depth: The attacker can do what they want in the application

We can confirm we have seen attack activity on Fastly's network, including exploitation attempts pre-disclosure.

What to do right now:

The PHP Foundation released patches this morning; we encourage all organizations to patch immediately if they can.

Assume every maintained PHP version is affected. At this time, the oldest demonstrated exploit path has been present since 2012. 

The patches fix the demonstrated exploit paths; the underlying architecture remains vulnerable. Expect novel variants and a ramp-up in exploitation attempts over the next 24 to 48 hours. 

Fastly NGWAF customers should immediately apply the Virtual Patch for CVE-2026-109618 & CVE-2026-109619 to all services that may be vulnerable.

Our detection content looks for the structural hallmarks of these exploitation attempts that may indicate potential exploitation attempts of php2shell CVEs.

Reach out if Fastly can provide immediate help for you to stay safe: support@fastly.com

Learn more about what’s going on, what to do, what’s next here: https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618

For some reason I’ve had this stuck in my head all day

https://youtu.be/u8ccGjar4Es

#KCDUK Day two! I’m the second keynote speaker today and I’m so excited to be speaking about how to be impactful and strategic as a high level IC

Check it out at 10:05!

KCD UK day one here I come! Unfortunately I forgot my contact lenses but I couldn’t sacrifice the aesthetic so I’ll be squinting at everyone ✨ elegantly ✨

Please feel free to say hi! I can’t wait to meet all of y’all

Why do I get an uncontrollable urge to consume sugar whenever i have a cold?

I severely underestimated how annoying the corset + petticoat + tights combo is for going to the bathroom. I understand why Victorian ladies of the court just refused to use bathrooms now 😅

Ready for the fireside chat that Liz Fong-Jones and I are doing today?

It’s titled “Observability Engineering: What’s Next?” And it’s going to be a wild ride. Bring your o11y questions for our Q&A session!

I might be spooky but observability doesn’t have to be 🫡

https://luma.com/srenl?e=evt-QrH4Dz3MbeLprxu

So the thing is, I absolutely 100% must give a keynote one day in a dress like this. It simply must happen

This entire brand has me in a chokehold and the only cure is more fashion

https://www.almeecouture.com/products/look-8-the-chateau-beneath-the-wisteria

The fact that one cannot sit down in a dress like this is entirely irrelevant. I will fast for three days and learn to float through the air itself if necessary. I need this on my body immediately. The whole collection

Who am I kidding, I’m obsessed with every collection of theirs. It’s so good 😭

I don’t know how to explain to people that just because certain things appear to approximately work doesn’t mean they actually work. This was already horrifically difficult before AI and now it’s damn near impossible to get the point across when literally any trivial example passes muster

The asymmetry between me having to provide a compelling defence that they can actually understand (without the required background knowledge) vs them being able to endlessly generate garbage in seconds is just… exhausting

At the tram stop just now, right next to some of the best bicycle infrastructure you'll ever see, an American tourist came to me to ask me if the Dutch government was doing anything about "this terrible bicycle problem" we have in the Netherlands. 🙃

Hey you, do you like o11y? Do you wanna know more about what’s next? What @lizthegrey.com and I are excited about? What’s comes to mind when we think about the challenges companies face?

Do you just want a shiny signed copy of the new observability book? (It’s ok, we won’t judge)

Come hang out!

https://luma.com/aeykzvc7

---

Logistics:

Date: Thursday, 8th October
Time: 18:00-21:00
Location: ING Cedar, Amsterdam
Vibes: immaculate, not coded
Insights: spicy and organic
Hazels outfit: fire, as always

Hey you, do you like o11y? Do you wanna know more about what’s next? What @lizthegrey.com and I are excited about? What’s comes to mind when we think about the challenges companies face?

Do you just want a shiny signed copy of the new observability book? (It’s ok, we won’t judge)

Come hang out!

https://luma.com/aeykzvc7

---

Logistics:

Date: Thursday, 8th October
Time: 18:00-21:00
Location: ING Cedar, Amsterdam
Vibes: immaculate, not coded
Insights: spicy and organic
Hazels outfit: fire, as always

Why yes I resemble every single one of these statements

*sobs in data architect*

https://youtu.be/FG8sUgjBGXs

Ever randomly get a deep flashback to an earlier time and crave something randomly? Anyways I was reminded that 3D Pinball Space Cadet existed today and, naturally, someone put it on a website

https://ksylvestre.itch.io/space-cadet-pinball

(Theres many versions now, even!)

Now, at the legislative and regulative layer, you can save a lot of effort over time by designing the “structure” of the specification to be modular and reusable

That works in enterprises as well!

Well, all the way up to “implementation.” For implementation… it depends

Manually implementing a regulatory obligation is actually quite nice, all things considered: you write a few documents, train people to follow the process, and create a paper trail that’s audited

If the regulation changes or evolves, the documents get updated in a clean manner and all is well
Automatically implementing a regulatory obligation, on the other hand, is utter hell. Automation in general is hell.

If it’s automated, you have to make an automated paper trail, automated measuring system, automated process, and so on. Both for the process *and* for showing that it wasn’t bypassed

That “showing it wasn’t bypassed” is particularly important. It means you need to understand the entire state space of what’s possible in the whole automation, and you need to exhaustively demonstrate fulfilment of the obligations (“within reason”)

In other words, anything dynamic is a fools dream

Imagine trying to take a Kubernetes operator and show that no matter what happens in the cluster, certain things cannot occur

Luckily, regulation isn’t quite at the level of “formally verifying arbitrary properties of complex systems” … but for automation it can get uncomfortably close

It gets even worse: That is *per* obligation

If you want to fulfil two obligations, the manual method scales extremely well. Most of the documentation structure carries over, and all of the training process, audit trail, etc, is typically reusable

If it’s automated, almost none of that is reusable

The consequences of fulfilling those obligations are numerous, and result in a substantial amount of pain, paperwork, audits, certification, and more.

Which means that the overhead of doing “one thing” becomes extraordinarily high

Doing “one thing” in a regulated environment, top to down, looks vaguely like this:

Governing body says
1. “you will be obligated to do this”
2. “here’s what outcome should be” and/or “here’s what your plan should look like”
3. “here’s how certifying fulfilment of obligation should look”

Operating body says
4.“here’s how we interpret that obligation”
5. “here’s how we interpret the outcome guidelines and/or implementation guidelines given”
6. “Heres how we plan to implement the fulfilment of our obligation”
7. “Here’s how we plan to show you that our implementation does fulfil the obligation and meets all criteria”
8. “Here’s how we plan to measure the efficacy of our implementation”
9. “Here’s how we plan to monitor ongoing fulfilment of the obligation”
10. “Here’s how we plan to be certifiable”

We are now on step 10. It’s been at least

* 4+ years of legislation work
* 4+ years of regulation work
For the governing body

* 2+ years of regulatory interpretation in the enterprise
* 1+ years of implementation planning
For the operating body

… and we haven’t started implementing anything yet

I’ve been working on something for a while that I think is pretty cool and I want to start talking about it soon. Here’s the elevator pitch tagline:

It’s a platform for creating dynamic procedures, processes, and actions that are (by construction) attested, evidenced, transparent, and trustworthy

Under the hood, this platform will be powered by a combination of remote attestation, behavioural evidence, and various policy engines depending on the use case

To my knowledge, this is the first time a platform like this has become feasible, and the standards are so new that some are still drafts

One of the more obvious questions you might have is “why do you need to build this?” The has a simple answer as well as an interesting one

The simple answer is that if you don’t have something like this, you pay a near exponential cost to automate anything in a regulated environment

Companies (and humans, computers, systems,…), no matter how complex, can only really do one thing at a time. So the overhead around “doing one thing” becomes very important, and so does changing the definition of what “one thing” is, and so does understanding *what* that “one thing” is

In a regulated industry, you have two other things that become vitally important: fulfilling obligations, showing your work, and having it independently verified

(Digging deeper into that would be an entire series of articles on its own. I’ll refrain from now but would like to cover more later)

Paper: “Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation”

"""
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. […] On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.
"""

https://arxiv.org/abs/2607.24888

RustNL's Rust Maintainer Team has grown and now consists of 14 people, including three interns! ✨️

https://rustnl.org/maintainers/

Together, these people are either the author or a reviewer of more than 30% of all pull requests on the rust-lang/rust repository:

OH: Does that make DLLs case law?