PHP zero-day

[Husna QA]

Ya, akhirnya Bitcointalk kembali bisa diakses setelah beberapa jam yang lalu memunculkan page 503 yang berisi informasi kalau forum sedang maintenance.
Penyebab maintenance tersebut jarang-jarang terjadi:



Berikut ini beberapa informasi terkait isu PHP yang saya kutip dari beberapa website lain:

- https://www.bbc.com/news/articles/cmly0lg3w5x2o

Websites taken down worldwide as critical cyber-security update issued

International governments and agencies have urged websites to address two critical cyber-security flaws in a programming language which powers much of the internet.

The vulnerabilities were found within the PHP programming language, with a fix issued on Wednesday afternoon.

Multiple cyber-security agencies have urged organisations unable to apply fixes in time to consider taking their sites down, leaving bodies such as the Finnish government, Edinburgh council and the BBC to take pages offline.

The flaws were discovered by AI, with cyber-security firm Wiz saying they were the "most severe vulnerabilities ever discovered" by the tech, which is reshaping the cyber landscape.

—snip—

- https://www.reuters.com/world/asia-pacific/eu-agency-warns-websites-may-need-be-taken-offline-php-prepares-patches-2026-10-21/

Government websites go dark after AI-discovered flaw sparks security scramble

Summary

• Dutch, French, Danish, and Finnish governments yank sites offline as hackers exploit weaknesses
• European and Asian cyber agencies urge users to update or take sites down immediately
• PHP developers say fix is now live, prompting scramble to update sites across the web
• Cyber company Wiz says it discovered flaw using tools from Google and OpenAI

- https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

Critical security issue affecting PHP

What has happened?

PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.

PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. PHP is also used in a range of other products.

The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.

• CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
• CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Saya belum tahu persis seberapa parah akibat yang terjadi pada website yang terdampak langsung dari isu keamanan PHP ini (semisal karena telat update atau lainnya).

[mu_enrico]

Setau ane karena ane juga pengguna PHP untuk website2 ane.
Ini keparahan nilainya 9,2/10 jadi emang parah banget karena penyerang bisa mengambil alih server, dampaknya mirip kek pengendalian di remote pc di windows.
Tapi server shared hosting ane down tidak lama, setelah patch langsung nyala lagi. Cloudflare dkk juga sudah mengamankan secara otomatis, sehingga praktis serangan sesudah disclosure dan cloud dns/firewall membuat pengamanan ya jauh berkurang risikonya.

Yang ane pahami tindakan maintenis bertujuan untuk preventif audit kode yang ada, apakah ada indikasi sudah disusupi atau belum. Ini merupakan SOP yang sangat baik dari Bitcointalk karena bisa saja serangan sudah terjadi jauh sebelum disclosure.

Ane sebetulnya sudah ada feeling sistem yang permukaan serangannya besar bakal lebih mudah diserang di era AI, misal PHP vs static, tentu PHP lebih rentan. Sudah dalam proses migrasi static build pakai node.js tapi belum selesai karena rebuild ratusan laman.

[atookz]

Saya belum tahu persis seberapa parah akibat yang terjadi pada website yang terdampak langsung dari isu keamanan PHP ini (semisal karena telat update atau lainnya).

Sebelumnya terimakasih agan @Husna QA untuk infonya, jujur baru kali ini saya ngerasain maintenance kayak gini, sebelumnya pernah nggak yaa gan? Soalnya pas buka bitcointalk tapi nggak bisa cukup panik juga gan  

Saya jadi penasaran, forum ini kan berjala di SMF yang berbasis PHP, jadi mungkin wajar yaa kalau kena imbas dan sempet maintenance. Kira2 udah ada kabar belum gan di group ini apakah ada indikasi eksploitasi sebelum patch rilis? Barangkali ada himbauan ke member buat ganti password mungkin atau cek lainnya gan, atau mungkin masih aman terkendali...

sistem yang permukaan serangannya besar bakal lebih mudah diserang di era AI, misal PHP vs static, tentu PHP lebih rentan.

Setuju gan soal permukaan serangan. Static build emang menghilangkan eksekusi kode di server, jadi nggak relevancelah kayak gini.
Soal cloudflare dkk, bener sihh bisa jadi  kayak virtual patch. Tapi buat celah yang kepicu lewat out of memory, saya belum yakin WAF bisa nutup semua pola requestnya.