cyber.hendryadrian.com
Vulnerability & Exploit · cert-agid.gov.it

Critical PHP Vulnerabilities Could Enable Remote Code Execution; Security Updates Released

· Original article ↗

Summary

PHP released fixes for two critical memory-management vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Exploitation may enable remote code execution in certain configurations; updates are available, while reported PoCs remain unverified.

Key points

  • Both vulnerabilities affect the PHP engine and have CVSS v4.0 scores of 9.2; exploitation may use specially crafted HTTP requests.
  • The PHP Security Team confirmed remote code execution with Apache mod_php and, under specific conditions, PHP-FPM.
  • Online PoCs claim to exploit the flaws, but their effectiveness has not been fully verified.
  • Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; users of unsupported versions should check for vendor patches or migrate to a supported version.
  • Updating a CMS or its plugins alone does not fix vulnerabilities in the PHP interpreter.
  • CERT-AGID recommends prioritizing internet-exposed PHP services, applying updates, and verifying the web server uses the corrected interpreter after restarting relevant processes.
  • If updates cannot be applied immediately, recommended temporary steps include restricting access and considering disabling session.upload_progress.enabled if unnecessary; these measures are partial and do not replace patching.

Article Details

Vulnerability Types
  • Memory-management vulnerabilities
  • Remote code execution
Severity
Critical (CVSS v4.0: 9.2)
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • If updates cannot be applied immediately, limit access to exposed services.
  • Disable session.upload_progress.enabled if it is not needed.
  • Apply limits to HTTP requests through the web server or a WAF.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article describes specially crafted HTTP requests exploiting PHP vulnerabilities in Internet-exposed services.

CVE

CVE-2026-109618di sicurezza per correggere due vulnerabilità critiche nel motore PHP, identificate come CVE-2026-109618 e CVE-2026-109619, entrambe caratterizzate da un punteggio CVSS v4.0 pari a 9.2.CVE-2026-109619per correggere due vulnerabilità critiche nel motore PHP, identificate come CVE-2026-109618 e CVE-2026-109619, entrambe caratterizzate da un punteggio CVSS v4.0 pari a 9.2.

Products

ApacheIl produttore ha confermato la possibilità di esecuzione di codice da remoto in ambienti Apache con mod_php e, per specifiche condizioni di sfruttamento, anche in ambienti PHP-FPM.PHPIl PHP Security Team ha pubblicato gli aggiornamenti di sicurezza per correggere due vulnerabilità critiche nel motore PHP, identificate come CVE-2026-109618 e CVE-2026-109619, entrambe caratterizzate da un punteggio

Related Articles