Skip to content
Sign in
Artwork for Breach Please
Breach Please · October 21 · 32 min

S0E56 -Two Critical PHP RCEs Drop Today — Don't Wait for the CISA KEV to Patch

Two critical PHP vulnerabilities (CVE-2026-109618) are getting patches today — a remote code execution bug spanning PHP 5 through current, with early severity estimates as high as a CVSS 10 (PHP's own advisory puts it at 9.2). Guest Richy fills in for Jake this episode and joins Jess to break down what's actually exploitable, why this hits vendor appliances hardest (you can't just drop an EDR on a closed-source box), and the one thing they disagree on: wait for a CISA KEV listing before acting, or patch now if you're internet-facing? (Jess says now.) Also in this episode: Why PHP is still everywhere you don't expect it — WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel, and Symfony, plus the vendor appliances and container images nobody remembers are running it. Richy's "proactive threat response" framework — running a hair-on-fire vulnerability like an incident, without calling it one, so you keep the communication lines and decision speed without the regulatory/insurance baggage. How to actually find PHP in your environment without a reliable CMDB: attack surface management tooling, EDR process queries, and vendor SBOMs. Guest: Richy, filling in for Jake Williams this episode. Sources: PHP's official advisory: https://www.php.net/archive/2026.php#2026-10-21-5 Watchtowr's FAQ (CVE-2026-109618): https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ Jekyllson's write-up: https://jackalsyn.com/posts/php-up-2026.html Join our Discord: https://discord.gg/wYJnTpczV

0:00-32:38
Play in

transcript

No transcript — this publisher did not publish one.

show notes

Two critical PHP vulnerabilities (CVE-2026-109618) are getting patches today — a remote code execution bug spanning PHP 5 through current, with early severity estimates as high as a CVSS 10 (PHP's own advisory puts it at 9.2). Guest Richy fills in for Jake this episode and joins Jess to break down what's actually exploitable, why this hits vendor appliances hardest (you can't just drop an EDR on a closed-source box), and the one thing they disagree on: wait for a CISA KEV listing before acting, or patch now if you're internet-facing? (Jess says now.) Also in this episode: Why PHP is still everywhere you don't expect it — WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel, and Symfony, plus the vendor appliances and container images nobody remembers are running it. Richy's "proactive threat response" framework — running a hair-on-fire vulnerability like an incident, without calling it one, so you keep the communication lines and decision speed without the regulatory/insurance baggage. How to actually find PHP in your environment without a reliable CMDB: attack surface management tooling, EDR process queries, and vendor SBOMs.

Guest: Richy, filling in for Jake Williams this episode.

Sources: PHP's official advisory: https://www.php.net/archive/2026.php#2026-10-21-5 Watchtowr's FAQ (CVE-2026-109618): https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ Jekyllson's write-up: https://jackalsyn.com/posts/php-up-2026.html Join our

Discord: https://discord.gg/wYJnTpczV

more episodes

All episodes