CVE-2026-10961{8,9}

[tobozo]

Hi,

Came here out of curiosity to ask if and how the latest CVEs affect this version of PHP.

Also sharing this project that came up in my timeline: https://github.com/syhunt/php2shell-protection

[GianfriAur]

I admit I haven’t tried it; I’m swamped with work on clients' machines, getting everything updated (nothing related to this project, though). That said, in theory, yes, it is affected (I’ll provide an update as soon as I can), BUT it doesn’t really pose a danger; given how it’s structured, a crash of that type simply resets the board and restarts everything. Not to mention that if you aren't using an SD card (as should be the case in a production environment), you can't create or modify files, you can only execute them.

[GianfriAur]

and of course having a remote shell is impossible there is no os, not to mention that there’s practically nothing here that isn’t PHP; it’s just PHP, the boot process, and potentially a database (SQLite). 😂😂😂

[tobozo]

malice always finds a way, I hope nobody uses php-esp32 to run a magento 🤣

[GianfriAur]

In any case, my update isn't that complicated, since I use the official PHP; I just need to update the PHP version. 😪