HOC Shorts |
The Emergency Release: The PHP development team issued an emergency security update covering PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- The Vulnerabilities: The patch fixes two critical, high-severity remote code execution (RCE) flaws rated CVSS 9.2: `CVE-2026-109618` (OOM memory corruption) and `CVE-2026-109619` (stale global state abuse).
- Attack Surface: Affects all PHP installations serving web requests (including PHP-FPM, Apache `mod_php`, php-cgi, FrankenPHP, and LiteSpeed), with `mod_php` presenting the highest immediate risk before application code execution.
- Required Action: Updating is the only complete defense. Administrators must upgrade immediately or apply temporary configuration workarounds if patching is delayed.
Critical PHP RCE Vulnerability Force Emergency Security Releases
The PHP development and security teams released emergency security updates across all active release branches—PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35—to address two critical, unauthenticated remote code execution (RCE) vulnerabilities.
Rated at CVSS 9.2, the flaws allow remote attackers to compromise web servers before application logic even initializes. All system administrators managing PHP-powered infrastructure are urged to apply updates immediately.
1. RCE via OOM Memory Corruption (`CVE-2026-109618` / `GHSA-w8hw-w9fx-j79w`)
The Mechanism: When PHP encounters an out-of-memory (OOM) condition, request cleanup routines can interrupt execution while internal request data is only partially initialized. During cleanup, the engine treats invalid partial data as valid structures, triggering memory corruption.
Impact: Can be triggered by unauthenticated requests to crash or hijack execution flow.
2. RCE via Stale Global State (`CVE-2026-109619` / `GHSA-6wmf-4rv5-p3rp`)
The Mechanism: Request-owned internal state variables can inadvertently survive after their backing memory has been freed. A subsequent request handled by the same persistent worker thread reuses that stale state before normal initialization resets it.
Impact: Enables attackers to inject or manipulate execution parameters across request boundaries in persistent environments like PHP-FPM.
Affected Server Environments & Risk Levels
According to the PHP security team, the risk is highest on Apache with `mod_php`, where a demonstrated exploit allows an unauthenticated request to trigger execution before any user application code runs.
| SAPI / Environment | Vulnerability Exposure | Recommended Mitigation |
Apache mod_php |
Highest Risk (Executes prior to app code) | Upgrade immediately; isolate server nodes |
| PHP-FPM / LiteSpeed | High Risk (Cross-request state leakage) | Upgrade immediately; restart worker pools |
| FrankenPHP / php-cgi | Critical Risk | Apply official security release binaries |
| PHP 8.1 and Older | Unsupported (No official patches) | Contact LTS vendor or build from source with backports |
Immediate Action Plan for Administrators
1. Upgrade Packages: Update production environments to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Linux distributions and LTS vendors (such as Ubuntu, Debian, Red Hat) have packages prepared.
2. Temporary Mitigations (If Patching is Delayed): While updates are the only complete solution, administrators can reduce exposure via targeted `php.ini` adjustments:
- For `CVE-2026-109618`: Set `memory_limit = -1` (via `php_admin_value` to prevent application overrides) and enforce strict `post_max_size` rules at the web server boundary.
- For `CVE-2026-109619`: Set `session.upload_progress.enabled = 0` globally and restart all worker pools.
