Also hp system management homepage (installed on HPE Proliant servers) all ship with PHP.. with no ASLR. There doesn’t appear to be a patch for that, you can use it to surf around flat networks as it drops you as SYSTEM/root.
There’s absolutely shit tons of exploits for PHP2Shell on GitHub and basically none of them actually work to RCE as nobody can figure out ASLR properly.
Which is good, because patching is going to take a long time.
https://php2shell.censys.com/
If you’re wondering why your million dollar cybersecurity vendor appliances don’t have ASLR enabled.
ASLR supporting PHP exploits are coming, probably next week.. but it’s a really good security control (from decades ago) you should demand your vendors actually enable as it enabled time for orgs paying attention to patch.
The cybersecurity vendor industry itself is essentially negligent when it comes to this stuff. https://infosec.exchange/@catc0n/117487878549556020
There is another PHP potential RCE vulnerability - CVE-2026-115560 - without a patch. Do not panic.
It is a non-default configuration and will not be a widespread issue.
The mitigations in this thread already fix it, if you want to panic.
PHP Foundation’s budget is about 700k a year. It’s used on something like 40 million websites. Almost no company who uses it contributes anything and many people work on it for free.
The latest trend is cybersecurity and AI vendors have realised they can vampire off its security for publicity (money).
Perhaps the world would be a better place if those orgs who rely on it just contributed sponsorship to the foundation, and vendors didn’t monetise vulnerabilities for themselves.
Security vendor Palo-Alto plans to release patches for their flagship firewall product to fix the PHP vulnerabilities in them sometime next week, after they’ve finished scratching their arse.
@GossiTheDog That toot says there's already a functional ASLR bypass poc out there...?
@christopherkunz there’s one on GitHub but it’s not super functional in reality.. plus people largely haven’t found it yet 🤣 it’d need more work to scale.
@GossiTheDog what is #aslr #php
Oct 23, 2026, 12:32 PM@GossiTheDog but yeah, php is a bad language and we should get rid of it.
Oct 23, 2026, 12:44 PMSo what Meta (who famously use PHP extensively in what used to be their flagship product) spent on the complete failure that was the metaverse (~$60 billion) could have funded them at current levels for close to 100,000 years
@GossiTheDog
Sure, but they knew about this since 2024!
So the main issue still is bad judgment on security here, as they invested their time and money obviously on other issues since then…
@MarkusStoll I hate to alarm you but there are likely other known, bigger issues. They need funding.
@GossiTheDog
I strongly doubt that there was a bigger issue than this, as this makes it very clear to everyone that you should avoid using PHP.
Still I concur, that whoever uses it, should contribute to this…
Oct 23, 2026, 1:04 PM@GossiTheDog Only an iota of humanity Please save my life by opening the link and seeing my story. Help me with one dollar or share
https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live
@GossiTheDog and to be honest they're not the worst ones. At least they do have a budget, and core developers on the payroll. And many thanks to the @sovtechfund for that audit financing in 2024!
@GossiTheDog It is unreal that over $85k didn't reach the team because of fees!
For such thankless work (you know these processing companies are benefitting from PHP somewhere in their business), you'd think we could get them to wave some fees.
@GossiTheDog Maybe do it like this?
@GossiTheDog No hurries, hmm?
@GossiTheDog When the newest PAN-OS version is rocking PHP 8.0.30 I assume that they've got themselves into a delightful backport hole.
An entirely predictable one that is their fault, of course.
@GossiTheDog i don't understand how these "security" people in companies buy from them
Same with heartbleed and openssl at the time. Multi billion corporations should give a couple of millions.
@GossiTheDog Someone never heard of defence in depth? ;)
Oct 23, 2026, 8:37 AM
@aetios @GossiTheDog I found this post really insightful: https://infosec.exchange/@david_chisnall/117308418842462706
In this sense ASLR is a non-durable mitigation
@GossiTheDog It doesn't work perfectly. Let's remove it then. 🤡
@GossiTheDog
It's always such a surprise when someone you respect has a dumb take... But then I remember that there are likely so many dumb takes of mine on the internet 😂
@GossiTheDog neat page, though it just assumes versions like 7.4 are unfixed, whereas probably many are using Sury’s PHP which definitely patched it (and I think even 5.6).
There’s probably no better way though to track, so still a useful infographic
@mig5 yeah if has clarifications for version numbers not being a bulletproof way. But still, orgs historically very bad at patching so it gives a rough indicator picture. Many are just on raw EOL versions, can also see they’re on EOL Redhat etc.
@GossiTheDog I can’t believe so many leave expose_php = On !
@GossiTheDog Presumably that may get confused by backports, i know some hosting control panel providers have backported to 7.4 for instance.
@GossiTheDog crap
