Breaking Security News Vulnerability Analysis 22/10/2026

PHP Armageddon: AI-Discovered Critical RCEs + Chainguard Embargo Breach

AI-powered research turned into one of the most serious PHP vulnerabilities in history. OpenAI and Google Wiz found critical pre-auth RCEs with AI models, and hours later the supply-chain security company Chainguard shipped patched images early, breaking the coordinated disclosure process — before the official patch was even packaged for most distributors.

📅 20 Οκτ 2026 🖥 PHP servers / sessions 🚨 Severity: Critical 9.2 🩹 Patch: 21/10, ~14:00 UTC 🔥 Pre-Auth RCE / Heap UAF
Live status: Emergency patches released for PHP 8.2–8.5 branches (21/10, ~14:00 UTC / 17:00 EEST). Site owners were warned to take unpatched sites offline. Chainguard: "We made the call" — broke embargo hours before coordinated release.
9.2
CVSS v4.0 · Critical
2
CVEs (CVE-2026-109618 / CVE-2026-109619)
5.4→8.5
Every PHP version of last decade affected
AI
Discovery: OpenAI + Google Wiz
6h
Chainguard embargo breach
70%
Websites on PHP

TL;DR — 3 Ενέργειες (3 Βήματα)

  1. Patch: Upgrade PHP 8.2–8.5 branches (~14:00 UTC, 21/10). EOL branches get emergency patch too.
  2. Disable upload progress: session.upload_progress.enabled = 0 in php.ini / block multipart POSTs via WAF.
  3. Hunt: grep logs for PHP_SESSION_UPLOAD_PROGRESS and check /tmp/.pc_once_* style artifacts on affected hosts.

Δομή

  1. 1. Executive Summary
  2. 2. PHP2Shell & τα CVE
  3. 3. Root Cause: Heap UAF
  4. 4. AI Discovery (OpenAI + Wiz)
  5. 5. Chainguard Embargo
  6. 6. Impact
  7. 7. Timeline
  8. 8. Playbook
  9. 9. IOCs
  10. FAQ

1. Executive Summary

20 Οκτ 2026: Η PHP δημοσίευσε έκτακτη δημοσίευση (emergency release) για δύο κρίσιμες προ-ταυτοποιημένες Remote Code Execution (RCE) (CVE-2026-109618 / CVE-2026-109619, CVSS v4.0: 9.2). Τα vulnerabilities ονομάστηκαν PHP2Shell από την ομάδα αναφοράς. Όλες οι εκδόσεις PHP της τελευταίας δεκαετίας (5.4.0 → 8.5.x) είναι επιδραστικές.

Το OpenAI και το Google Wiz βρήκαν τα bugs μέσω AI models. Η Chainguard, security vendor του supply chain, έδωσε στο παρόν το "παρά το γεγονός" — αν και το έκανε για καλό σκοπό (να μην αργήσουν οι patches), το έσπασε το embargo της coordinated disclosure.

2. PHP2Shell & τα CVE

Τα CVE-2026-109618 (RCE via out-of-memory corruption) και CVE-2026-109619 (RCE via stale state) οδήγησαν σε pre-auth RCE — δηλαδή χωρίς authentication. Το OpenAI + Wiz ανέφεραν ότι το "AI found and prevented" το bug, αλλά "is also a high risk because of AI".

3. Root Cause: Heap Use-After-Free

Το ext/session/session.c PHP core handler php_session_rfc1867_callback + feature session.upload_progress. Στο PHP 5.4 (2012) το feature ενεργοποιήθηκε από προεπιλογή (default-On). Τα multipart POSTs μπορούσαν να "poison" τη session, οδηγώντας σε UAF και pre-auth RCE.

4. AI Discovery: OpenAI + Google Wiz

Τα bugs εντοπίστηκαν μεταξύ August και September 2026 με AI models. Το OpenAI + Wiz δημοσίευσαν advisory. Η Chainguard, μετά, μείωσε το embargo — "didn't leak" per CEO Dan Lorenc — αλλά το shipped patches early.

5. Chainguard Embargo Breach

Στις 21/10, 07:41 UTC, η Chainguard έδωσε το παρόν: "shipped built images containing the fix" 6 ώρες πριν τη coordinated release. Το "Distributors were still packaging the fix, so releasing immediately would have left many users without an easy way to update."

6. Impact

PHP = ~70% των ιστοσελίδων. Δεκαετίες εκδόσεων. Αντιμετώπιση: patch, disable upload progress, WAF block multipart, log hunting.

7. Timeline

20/10/2026 — Coordinated disclosure prep
OpenAI + Wiz + PoC bundles
21/10/2026 — Chainguard embargo breach
Built images shipped early
21/10/2026 — Emergency patch
PHP 8.2–8.5 patched (14:00 UTC)

8. Playbook

8.1 Early mitigation: disable upload progress

; php.ini (conf.d/*.ini) → PHP-FPM config
session.upload_progress.enabled = 0

8.2 WAF level: block multipart/form-data POSTs

# NGINX (server block → PHP):
# Block: multipart uploads! Set session.upload_progress accordingly
# For upload endpoints, use scope-appropriate rules.
if ($content_type ~* "multipart/form-data") {
    return 403;
}

9. IOCs

9.1 Log hunting: PHP_SESSION_UPLOAD_PROGRESS

# Apache/Nginx access logs → multipart POSTs
grep -i "PHP_SESSION_UPLOAD_PROGRESS" /var/log/apache2/access.log
grep -i "PHP_SESSION_UPLOAD_PROGRESS" /var/log/nginx/access.log

# ModSecurity audit logs
grep -ri "PHP_SESSION_UPLOAD_PROGRESS" /var/log/modsec_audit/

FAQ

Τι ήταν το PHP Armageddon;

AI-powered discovery of critical pre-auth RCEs (CVE-2026-109618/109619, CVSS 9.2, PHP2Shell) affecting all PHP versions since 5.4.0.

Τι έκανε η Chainguard;

Shipped patched built images 6 ώρες πριν τη coordinated disclosure, breaking the embargo process.

Πηγές & Συμβουλές