Security Through Binary Patching: fixing critical PHP CVEs with radare2 in 24 bytes, no recompile
SIGKITTEN · x · 2026-10-23
radare2 author pancake demonstrates patching the two critical PHP RCEs (CVE-2026-109618, an OOM-handling bug, and CVE-2026-109619, a cross-request use-after-free) directly in binaries, without recompiling or waiting for distro updates. With the gap between upstream fix and sysadmin patching being actively scanned by attackers, he suggests interim mitigations (disable multipart/form-data in Apache, rewrite headers at the proxy) and shows how 24 bytes of binary patches via r2 oneliners neutralize the bugs — plus tangents like having an LLM rewrite PHP into a Rust FastCGI.
More from Safety
- Leaked PHP2Shell RCEs (CVSS 9.2) Draw Scans 20 Minutes After Patch, No Confirmed Exploits Yet — cyb3rops · 2026-10-23
- Chinese AI labs embrace 'recursive self-improvement' — but the story is bottom-up, not state-coordinated — Afinetheorem · 2026-10-23
- AI researcher: even dumb models are now powerful hacking tools, sparking an AI cyber arms race — Yuchenj_UW · 2026-10-23
- David Sacks: user-authorized AI agents sharing bank credentials aren't cyberattacks — kevinnbass · 2026-10-23
- Brotli memory corruption bug CVE-2026-111497 reproduced with a simple Node.js app — evilsocket · 2026-10-23
- DeepSeek and MiniMax clear China's new AI export rules for overseas releases — Stannis_Loyalist · 2026-10-23