Antumbra + CVE-2026-109618/109619

An interesting day today... PHP is old tech, sure, but I've always liked it for smaller scripts, APIs, and so on. It usually just... works. But today we were reminded of how badly things can break, too.

CVE-2026-109618 / CVE-2026-109619, collectively known as PHP2Shell, hit us, and the vulnerabilities potentially affect sites running PHP versions all the way back to 5.4, including newer 8.x releases.

Essentially, both vulnerabilities involve PHP mishandling memory during or between requests. By sending specially crafted HTTP requests, an unauthenticated attacker could trigger memory corruption or access memory that had already been freed, potentially allowing them to execute arbitrary code on the server without authentication. Scary stuff, especially considering how widely PHP is used.

Fortunately, fixes have now been released (PHP 8.2.35, among others), and updated packages should be installed through APT or your distribution's package manager as soon as they're available.

This will probably only get worse going forward, too. AI has truly been a paradigm shift here, and it feels rather dystopian if I'm gonna be honest.

In other news, while upgrading PHP/FPM, I also made some tweaks to the site, and the current build has been bumped to Antumbra.

- emy