Low Level

i make computer do bad
🧙 security researcher
📺 1M+ youtube
prev: fuzzers & hypervisors @microsoft

Business: [email protected]

[Low Level @LowLevelTweets]

https://t.co/0MLQ8Bvy7B

[Low Level @LowLevelTweets]

@moyix PPPPPPPPPPPPPPPPPPPPPPPPPPPPP

[Low Level @LowLevelTweets]

@moyix

[Low Level @LowLevelTweets]

@kernelstub Their firmware crypto is so wacky lmao

[Low Level @LowLevelTweets]

YOU CAN STOP THE BUG WITH A PHP.INI FILE GOGOGOGOGO

[Andrew Dorman @acd421]

Teamwork makes the dream work.

The team and I
@J4ck3LSyN @Archknight23

🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow.

The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2.

📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up.

PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act.

Here's the part the big threat-intel shops aren't shouting about:

No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling:

🔹 Present since PHP 5.4
🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live)
🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config

That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands.

✅ What to do right now:

1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade.

2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess:

session.upload_progress.enabled = Off

Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths.

3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers.

4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today.

Why I'm posting this for free:

A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response.

I'll follow up once the official advisory publishes and confirm whether my root cause read was right.

Stay patched. 🔒

#PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

[Taylor Otwell @taylorotwell]

Critical PHP vulnerabilities to be disclosed tomorrow: https://t.co/Wj7Fz7x8Bt.

We're working directly with the PHP Foundation to get patched PHP versions into our base images for Laravel Cloud, Forge, and Vapor ASAP.

You may need to redeploy your apps at that time to use these patched versions, but we're also working on the ability to silently patch applications without needing a redeployment.

All customers have been emailed and we will be providing further updates via email as the situation evolves.

[Low Level @LowLevelTweets]

@RollNeedLIVE where'd you get my thumbnail

[Low Level @LowLevelTweets]

hey man. if you run php.

turn it off.

[Florian Roth ⚡️ @cyb3rops]

Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now:

process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity

Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage. And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability.

From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes. It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process.

Quick start: https://t.co/7nluFV3Q25
Project: https://t.co/45agyRKtnS

[Low Level @LowLevelTweets]

@canonicalmodel @endingwithali i am aware of how vm escapes work

[Low Level @LowLevelTweets]

WARNING

[watchTowr @watchtowrcyber]

We were all supposed to wait until Thursday at 11am ET.

Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619

We cannot share further information right now. Take this seriously and apply patches when available.

[Low Level @LowLevelTweets]

@levelsio 👀

[Low Level @LowLevelTweets]

@typecraft_dev lol

[Low Level @LowLevelTweets]

@UK_Daniel_Card “you need to use GLM or Kimi” okay reasonable

“self replicate” …brother lmao

[Low Level @LowLevelTweets]

@MichelleBakels thnk u tim apple 👍

[Low Level @LowLevelTweets]

@timo_rf @evilsocket Has to be ragebait lmao no way

[Low Level @LowLevelTweets]

holy shit this is so bad lol. wormable RCE over the air

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: A Broadcom Wi-Fi bug lets anyone in range run code on routers without the password.

Quentin Kaiser showed it on Proximus, Orange Belgium and VOO routers and estimates ~1.5M in Belgium are exposed, none patched.

The bug dates to 2010. Broadcom won't assign a CVE.

[Low Level @LowLevelTweets]

@sweis Wait so if the seeds are just Unix timestamps, what’s the deal with the “lost passphrase seed” story?

[Steve Weis @sweis]

13 years of tinfoil hats for srand48(time(NULL)

[Low Level @LowLevelTweets]

huh, same combination as my luggage

[Pirat_Nation 🔴 @Pirat_Nation]

A hacker got access to personal data belonging to more than 8.8 million people in Denmark, and the password involved was apparently just “123456”.

The company, Pays ApS, had legitimate access to Denmark’s Central Register of Persons, which contains sensitive information like names, addresses and personal ID numbers.

According to reports, three accounts at the company were using “123456” as their password. One of them was an admin account.

The attacker used the account to make around 14 million searches in the database.

The breach wasn’t discovered immediately. It was only noticed later when an unusually large invoice showed that the company had been making a massive number of database searches.