Appsec and cloudsec crazy, CEO & founder and @sec_phoenix and @nsc42ltd board of @csaukchapter London host of @podcast_cyber
London, England
Joined September 2018
- Tweets19.4K
- Following1.6K
- Followers5.7K
- Likes25.8K
Pinned Tweet
Check out this great conversation: Chris romeo live no xitter.cf/i/broadcasts/1BdxYrROW…
This is genuinely a different report! And beautiful to look at #php2shell
Do you know who illustrated the comic on calif.io/php2shell?
Her name is Stephanie Cortes. And her husband is the hacker who discovered php2shell: @lcfr_hax.
This artist-hacker couple has the best story, stay tuned!
A potentially “weaponized” PHP RCE exploit is circulating today—see below for a breakdown. Before you run it: don’t. A bundle is circulating that claims a full chain for the two embargoed PHP core flaws — CVE-2026-109618 and CVE-2026-109619.
Don't get me wrong, we have a campaign and are looking at remediation action asap this is bad, is internet-exposed, and is easy when it drops.
#php2rce #vulnerability #exploit #writeup #cybersecurity #PHP #PHP2Shell
🤖 Made with AI
Link to the analysis phoenix.security/php-core-rc…
#php2rce #vulnerability #exploit #writeup #cybersecurity #PHP #PHP2Shell
Link ot the original exploit xitter.cf/J4ck3LSyN/status/21127…
... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> jackalsyn.com/posts/php-up-2…
> Courtesy of Me, @acd421 & @Archknight23
#CyberSecurity #infosec #php2shell #php
There are inconsistencies here as well. Another potential rce
... get it while its hot... 😈
> CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x)
> session.upload_progress UAF
> jackalsyn.com/posts/php-up-2…
> Courtesy of Me, @acd421 & @Archknight23
#CyberSecurity #infosec #php2shell #php
Potential vulnerabilities rce unverified and there are inconsistencies
This quoted post is unavailable.
For all the pho fighter out
Inventory all the php servers
2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:
session.upload_progress.enabled = Off
Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.
3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.
4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.
Good luck for all teams with #php Two critical PHP RCEs patch today.
~884,000 hosts will never get the fix.
🤖 Made with AI
Reachability analysis.
It finds every PHP runtime in your estate and separates what you can defer from what’s genuinely exploitable. check phoenix aspm andn details on the vulnerability phoenix.security/php-core-rc…