[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"nav-games":3,"post-the-php-vulnerability-situation-is-crazy":49,"blog-the-php-vulnerability-situation-is-crazy-1792701738253":78},[4,14,19,24,29,34,39,45],{"slug":5,"name":6,"tagline":7,"status":8,"visibility":9,"accent":10,"cardImage":11,"iconImage":10,"serverIp":10,"nativeVersion":12,"supportedVersions":13},"bedwars","Bedwars","Protect your bed and destroy others'!","live","public",null,"https:\u002F\u002Fmc.marcloud.net\u002Fcdn\u002Fwebsite\u002Fgames\u002Fbedwars.webp","1.8.9","1.8 — 1.21.4",{"slug":15,"name":16,"tagline":17,"status":8,"visibility":9,"accent":10,"cardImage":18,"iconImage":10,"serverIp":10,"nativeVersion":12,"supportedVersions":13},"knockit","KnockIT","Knock your opponents off into the void!","https:\u002F\u002Fmc.marcloud.net\u002Fcdn\u002Fwebsite\u002Fgames\u002Fknockit.webp",{"slug":20,"name":21,"tagline":22,"status":8,"visibility":9,"accent":10,"cardImage":23,"iconImage":10,"serverIp":10,"nativeVersion":12,"supportedVersions":13},"mlg-rush","MLG Rush","Rush your opponent on a narrow bridge!","https:\u002F\u002Fmc.marcloud.net\u002Fcdn\u002Fwebsite\u002Fgames\u002Fmlgrush.webp",{"slug":25,"name":26,"tagline":27,"status":8,"visibility":9,"accent":10,"cardImage":28,"iconImage":10,"serverIp":10,"nativeVersion":12,"supportedVersions":13},"speedbuilders","SpeedBuilders","Memorize and recreate a build as fast as you can!","https:\u002F\u002Fmc.marcloud.net\u002Fcdn\u002Fwebsite\u002Fgames\u002Fspeedbuilders.webp",{"slug":30,"name":31,"tagline":32,"status":8,"visibility":9,"accent":10,"cardImage":33,"iconImage":10,"serverIp":10,"nativeVersion":12,"supportedVersions":13},"luckrace","LuckRace","Compete in a parkour race and open lucky blocks!","https:\u002F\u002Fmc.marcloud.net\u002Fcdn\u002Fwebsite\u002Fgames\u002Fluckrace.webp",{"slug":35,"name":36,"tagline":37,"status":8,"visibility":9,"accent":10,"cardImage":38,"iconImage":10,"serverIp":10,"nativeVersion":12,"supportedVersions":13},"kitpvp","KitPVP","Fight against other players in a kit-based PVP arena!","https:\u002F\u002Fmc.marcloud.net\u002Fcdn\u002Fwebsite\u002Fgames\u002Fkitpvp.webp",{"slug":40,"name":41,"tagline":42,"status":8,"visibility":9,"accent":10,"cardImage":43,"iconImage":10,"serverIp":10,"nativeVersion":44,"supportedVersions":13},"creative","Creative","Build to your heart's content in a creative world!","https:\u002F\u002Fmc.marcloud.net\u002Fcdn\u002Fwebsite\u002Fgames\u002Fcreative.webp","1.12.2",{"slug":46,"name":47,"tagline":48,"status":8,"visibility":9,"accent":10,"cardImage":10,"iconImage":10,"serverIp":10,"nativeVersion":44,"supportedVersions":13},"murder-mystery","Murder Mystery","Secretly eliminate players, or stay alive!",{"post":50,"notFound":57,"related":62},{"id":51,"title":52,"date":53,"author":54,"authorMcUsername":54,"summary":55,"content":56,"image":10,"major":57,"editedAt":58,"editedBy":54,"tags":59,"visibility":9,"section":60,"readingMinutes":61},"the-php-vulnerability-situation-is-crazy","The PHP Vulnerability situation is crazy",1792701293677,"Marcelektro","My PoC and thoughts on the CVE-2026-109618 \u002F CVE-2026-109619 PHP critical vulnerabilities for RCE","The 21st of October 2026 was a fun day for the IT guys for sure. I'm one of them. Here's my insight.\n\n\n\nIt's one of a kind experience to wake up to the news, especially since it's a RCE (remote code execution) and then not even knowing how many servers I had running PHP that I'd have to patch. \n\nThe journey started with reading what I could that was already published. No PoCs to be found. \n\nThen I wrote a shell script that would scan the entire host for PHP versions that were vulnerable, including recursively finding all containers and VMs. I found... a few. \n\nI immediately ran the update and restarted the running processes. \n\nAfter all apps ran the patched version, I wanted to investigate a little. \n\n## My PoC\n\nWith the help of my friend I put together a PoC that I ran against my apps. For obvious reasons I won't share it here, but basically it takes plenty of conditions being met before the RCE can be done. It's as easy as Log4shell (that one I also remember happening live). \n\nEventually I ran a post request that gave a remote command execution on a simple PHP file upload demo app off GitHub. \n\n## Didn't patch yet?\n\nGO OFFLINE NOW and update the versions to the patched ones. Then test again, restart running processes to ensure no vulnerable code is still running. \n\nAnd stop using php lmao if possible. \n\n\n\n## Was anything related to marCloud vulnerable?\n\nWe don't use php. But other apps I ran for other people did so I still enjoyed my time. :\u002F\n\n\n\n## Have questions or need help?\n\nFeel free to ask me anything on my discord server: [https:\u002F\u002Fdiscord.gg\u002FyaftWcn](https:\u002F\u002Fdiscord.gg\u002FyaftWcn)\n\n:D",false,1792701738253,[],"blog",1,[63,71],{"id":64,"title":65,"date":66,"author":54,"authorMcUsername":54,"summary":67,"content":10,"image":68,"major":57,"editedAt":69,"editedBy":54,"tags":70,"visibility":9,"section":60,"readingMinutes":61},"mlg-rush-server-1-8","MLG Rush server 1.8",1792662182801,"Want a free 1.8.8 MLG Rush server that will never shut down? We got you!","\u002Fmedia\u002FHTbtlaEDVJRIEErj\u002F1600w.webp",1792664084017,[],{"id":72,"title":73,"date":74,"author":54,"authorMcUsername":54,"summary":75,"content":10,"image":10,"major":57,"editedAt":76,"editedBy":54,"tags":77,"visibility":9,"section":60,"readingMinutes":61},"first-blog-post","First blog post",1792626125493,"The first post on the website, maybe because the blog feature has just been... RELEASED!",1792695946348,[],{"data":79,"body":80,"toc":183},{},{"type":81,"children":82},"root",[83,91,96,101,106,111,116,123,128,133,139,144,149,155,160,166,179],{"type":84,"tag":85,"props":86,"children":87},"element","p",{},[88],{"type":89,"value":90},"text","The 21st of October 2026 was a fun day for the IT guys for sure. I'm one of them. Here's my insight.",{"type":84,"tag":85,"props":92,"children":93},{},[94],{"type":89,"value":95},"It's one of a kind experience to wake up to the news, especially since it's a RCE (remote code execution) and then not even knowing how many servers I had running PHP that I'd have to patch.",{"type":84,"tag":85,"props":97,"children":98},{},[99],{"type":89,"value":100},"The journey started with reading what I could that was already published. No PoCs to be found.",{"type":84,"tag":85,"props":102,"children":103},{},[104],{"type":89,"value":105},"Then I wrote a shell script that would scan the entire host for PHP versions that were vulnerable, including recursively finding all containers and VMs. I found... a few.",{"type":84,"tag":85,"props":107,"children":108},{},[109],{"type":89,"value":110},"I immediately ran the update and restarted the running processes.",{"type":84,"tag":85,"props":112,"children":113},{},[114],{"type":89,"value":115},"After all apps ran the patched version, I wanted to investigate a little.",{"type":84,"tag":117,"props":118,"children":120},"h2",{"id":119},"my-poc",[121],{"type":89,"value":122},"My PoC",{"type":84,"tag":85,"props":124,"children":125},{},[126],{"type":89,"value":127},"With the help of my friend I put together a PoC that I ran against my apps. For obvious reasons I won't share it here, but basically it takes plenty of conditions being met before the RCE can be done. It's as easy as Log4shell (that one I also remember happening live).",{"type":84,"tag":85,"props":129,"children":130},{},[131],{"type":89,"value":132},"Eventually I ran a post request that gave a remote command execution on a simple PHP file upload demo app off GitHub.",{"type":84,"tag":117,"props":134,"children":136},{"id":135},"didnt-patch-yet",[137],{"type":89,"value":138},"Didn't patch yet?",{"type":84,"tag":85,"props":140,"children":141},{},[142],{"type":89,"value":143},"GO OFFLINE NOW and update the versions to the patched ones. Then test again, restart running processes to ensure no vulnerable code is still running.",{"type":84,"tag":85,"props":145,"children":146},{},[147],{"type":89,"value":148},"And stop using php lmao if possible.",{"type":84,"tag":117,"props":150,"children":152},{"id":151},"was-anything-related-to-marcloud-vulnerable",[153],{"type":89,"value":154},"Was anything related to marCloud vulnerable?",{"type":84,"tag":85,"props":156,"children":157},{},[158],{"type":89,"value":159},"We don't use php. But other apps I ran for other people did so I still enjoyed my time. :\u002F",{"type":84,"tag":117,"props":161,"children":163},{"id":162},"have-questions-or-need-help",[164],{"type":89,"value":165},"Have questions or need help?",{"type":84,"tag":85,"props":167,"children":168},{},[169,171],{"type":89,"value":170},"Feel free to ask me anything on my discord server: ",{"type":84,"tag":172,"props":173,"children":177},"a",{"href":174,"rel":175},"https:\u002F\u002Fdiscord.gg\u002FyaftWcn",[176],"nofollow",[178],{"type":89,"value":174},{"type":84,"tag":180,"props":181,"children":182},"d",{},[],{"title":184,"searchDepth":185,"depth":185,"links":186},"",3,[187,189,190,191],{"id":119,"depth":188,"text":122},2,{"id":135,"depth":188,"text":138},{"id":151,"depth":188,"text":154},{"id":162,"depth":188,"text":165}]