CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
/tmp/.a
- Tweets 67,485
- Following 5,004
- Followers 74,900
- Likes 145,206
Here we go
Teamwork makes the dream work.
The team and I
@J4ck3LSyN @Archknight23
🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.
The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.
📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.
PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.
Here's the part the big threat-intel shops aren't shouting about:
No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:
🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config
That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.
✅ What to do right now:
1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.
2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:
session.upload_progress.enabled = Off
Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.
3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.
4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.
Why I'm posting this for free:
A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.
I'll follow up once the official advisory publishes and confirm whether my root cause read was right.
Stay patched. 🔒
#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec
2
1
21
2,900
Justin Elze retweeted
I, for one, consider 4 a perfectly fine integer between 1 and 39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942642
13
104
1,486
19,903
Justin Elze retweeted
Hey, they used a proper PRNG!
xkcd.com/221/
3
11
901
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
23
141
1,155
106,082
Justin Elze retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
66
904
3,682
538,748
Justin Elze retweeted
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
31
119
1,459
125,876
Justin Elze retweeted
🧨🔥 php.net
PHP powers Wikipedia, WordPress publishing and business websites, WooCommerce online stores, Drupal sites and Adobe Commerce storefronts
w3techs.com/technologies/det…
1
14
59
7,911
Justin Elze retweeted
We were all supposed to wait until Thursday at 11am ET.
Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619
We cannot share further information right now. Take this seriously and apply patches when available.
18
109
485
81,508
Justin Elze retweeted
Why not focus this as how great the model is for defenders instead of framing it as how dangerous a model could be in the wrong hands?
We found DeepSeek V4.1 Flash 1017 beats GPT 6 Sol on our multi-step offensive cybersecurity task. Sol was tested via the Daybreak trusted access program.
We have been building a cybersecurity benchmark based on simulated corporate networks. This is a valuable indicator for the cyber-risk a model poses if in the hands of a bad actor. We plan to make the full evaluation public in the coming weeks but wanted to share our first immediate finding here.
1
4
7
885
Justin Elze retweeted
Security researchers play an essential role in helping Microsoft protect customers, and we appreciate the time and expertise that goes into every vulnerability report.
Many researchers already provide the detailed, actionable reports our teams need to reproduce and assess vulnerabilities quickly. Starting October 20, Microsoft bounty programs will use Complete and Not Complete report assessments to make those expectations clearer and help provide more predictable bounty awards.
Learn what makes a report Complete and how to prepare your next submission in our blog: aka.ms/complete-report-blog
4
11
101
9,256
I thought the first rule of EDR Reversing Club was you don’t talk about EDR Reversing Club.
Your EDR Has Boundary Issues.
@harmj0y and @tifkin_ of @SpecterOps explore how adversarial machine learning can evade EDR detection- and how LLMs are accelerating the reverse engineering behind it.
Watch their Offensive AI Con talk below. 👇
piped.video/watch?v=GNDMDI_p…
#OAIC #OffensiveAI #Cybersecurity #EDR
4
2
92
6,270
When someone actually has an effective agent swarm, I suspect it’ll spend more time working offline recreating target environments, reverse engineering EDRs, and building exploits than hammering every app, API, and port. Stealth ends up being preparation.
You can run Nessus, every web scanner imaginable, BloodHound, etc. simultaneously, and something will probably shake out. You’re also lighting up traditional detection tools and whatever comes next.
The real value is a “one shot, one kill” mentality. Recreate the target environment and its defenses in a lab, understand the EDR and its nuances, and work through failures offline before touching the actual target.
More hands banging on keyboards in a compromised environment, even robot hands, isn’t how you maintain stealth. Unless your goal is smash and grab(ransomware), but that’s a wildly different conversation.
9
7
64
3,558
LLMs are iteration machines which is the opposite of stealth
Good read from @TalosSecurity's Jerzy 'Yuri' Kramarz on AI agent attacks. His take: what we have seen so far looks like a loud pentest, high volume and off-the-shelf tooling. The real risk is when swarms get told to stay quiet and run like a red team. blog.talosintelligence.com/o…
7
9
64
4,400
If you want to layer on the idea of using a swarm/multiple agents there are more chances to get caught or hit a detection.
The nature of this lends its self to smash and grab/ransomware attacks.
1
1
9
702
Justin Elze retweeted
this is the reason I never understand people who shit on open-weight LLMs. Opus 5.5 guardrails are absolutely trash when it comes to certain workload class.
i don't want daybreak access or to be inside secret 1000IQ glasswing programs with all my national IDs submitted to US govt to reverse engineer my Wiz smartbulbs so I can operate them from my Mac instead of their phone app (which btw needs a dedicated WiFi network for some reason to operate instead of just operating over bluetooth).
28
13
438
22,343