Subject: Validation and thanks — Kali php8.4 8.4.27-1 resolves CVE-2026-109618 and CVE-2026-109619

Hello Kali maintainers,

Thank you for importing php8.4 8.4.27-1 into kali-rolling on 23 October 2026.

I independently validated the update on a Kali rolling workstation previously running php8.4 8.4.24-1. Before the repository update, Apache and nginx were inactive, PHP-FPM was absent, and the Apache PHP module was disabled as a temporary mitigation.

Independent validation performed without Git/GitHub or exploit execution:

• authenticated PHP 8.4.27 using the PHP 8.4 release-manager keyring;
• authenticated Debian security source php8.4 8.4.27-1~deb13u1 using its signed .dsc;
• confirmed the PHP-signed and Debian-signed upstream archives were byte-identical;
• source SHA-256: dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0;
• built a minimal PHP 8.4.27 CLI inside a networkless Bubblewrap sandbox;
• normal execution passed;
• controlled memory exhaustion terminated with status 255;
• three applicable upstream OOM regression tests passed with zero failures and zero warnings; one additional test was skipped because the minimal build excluded pcntl/posix.

The official Kali packages were then installed successfully:

• php8.4-cli 8.4.27-1
• php8.4-common 8.4.27-1
• php8.4-opcache 8.4.27-1
• php8.4-readline 8.4.27-1
• php8.4-mysql 8.4.27-1
• libapache2-mod-php8.4 8.4.27-1

Post-install verification:

• PHP 8.4.27 / Zend Engine 4.4.27, built by Debian;
• Apache and nginx remain disabled and inactive;
• PHP-FPM remains absent;
• Apache PHP module remains disabled;
• no listeners were present on ports 80 or 443.

Local evidence archive:
KALI-PHP2SHELL-EVIDENCE-2026-10-23.tar.xz
SHA-256: cf6dadfd337499fdfc336871aef0831fb010acafc11fd28a82fd2daea9c24b51

This is a validation and thank-you note, not a report of an unresolved defect. No exploit was developed or executed.

Regards,
Mukonda Kangwa
Email: [email protected]
Phone / Airtel: +260 773 695 472
Lusaka, Zambia