Post: Another PHPocalypse: CVE-2026-109618 and CVE-2026-109619

damian.buho@proton.me (Damián Búho) — Wed, 21 Oct 2026 19:24:47 GMT

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet.

In short, if you didn't update your PHP on the 21st, you're in danger.

You can check if you're vulnerable via a self-hosted script or the Brandefense ATLAS checker.

Personal Experience

I had only one vulnerable service: Matomo Analytics (and Matomo's reaction to most of their users getting screwed is quite underwhelming). Custom image on a custom PHP distribution.

And even though it's a sad day for the internet, I am quite amused by my OCD paying off:

Matomo was inside a rootless container
On a rootless container runtime
With an isolated network
Container had cap_drop and no-new-privileges
Separate database and cache
All consumers of the analytics script had it locally pinned or used Subresource Integrity
CI blocked any attempts by nightly builds to publish an image with an old PHP interpreter

There are some things that definitely need improvement, but overall, it's nice not to be in a panic.

Shameless Plug

Ironically, my second specialization after CI/CD/Platform Engineering is the modernization of PHP applications (I've spent 20 years in PHP-related development).

If you need something pulled out of the 7.x bog, help with fixing modern deployments, or assistance in preventing/minimizing damage in the future, send me an email.

I would also point out that this won't be the last drama of its kind, so embrace it.

Brave new world: people without skills or responsibility wielding one of the most powerful tools in human history.

Project: Uwindaji Kit

damian.buho@proton.me (Damián Búho) — Tue, 01 Sep 2026 03:58:52 GMT

I needed an automatic system that could gather and store intelligence with evidence-grade quality.

It's an interesting experiment: using "agentic workflows" for something that actually matters.

Closed-source project.

Project: Custodio

damian.buho@proton.me (Damián Búho) — Sun, 03 May 2026 21:35:30 GMT

I was a digital nomad for many years, and had multiple surprises. From floods, volcanos and earthquakes to one less-known holiday in Argentina when all the shops are closed.

And I don't like surprises. So I decided to build a service that constantly calculates your risks and warns you about things you should now for your location in space and time.

With respect to privacy, notification fatigue and total customization.

#Security — Seconds to Midnight

Post: Another PHPocalypse: CVE-2026-109618 and CVE-2026-109619

Personal Experience

Shameless Plug

Project: Uwindaji Kit

Project: Custodio