{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/763488#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nTwo memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve arbitrary code execution.\r\n\r\n### Description\r\nPHP is a widely used open-source scripting language designed for web development and server-side applications. It powers millions of websites and web applications worldwide and can be deployed through a variety of server configurations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.\r\n\r\n**CVE-2026-109618**: A memory corruption vulnerability exists in the out-of-memory (OOM) handling mechanism of PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The vulnerability occurs when an OOM condition interrupts request processing while internal request data is only partially initialized; subsequent cleanup routines may access the invalid memory, potentially causing memory corruption and enabling arbitrary code execution.\r\n\r\n**CVE-2026-109619**: A use-after-free vulnerability exists in the global state management of PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The vulnerability occurs when a worker retains a reference to request-owned state after its backing memory has been freed. A subsequent request handled by the same worker can access this stale state before normal request initialization resets it, potentially causing memory corruption and enabling arbitrary code execution.\r\n\r\n### Impact\r\nSuccessful exploitation of these vulnerabilities allows an unauthenticated attacker to remotely execute arbitrary code via specially crafted HTTP requests, compromising the confidentiality, integrity, and availability of the web service and underlying infrastructure. Apache mod_php deployments are at particularly high risk, as proof-of-concept exploitation has demonstrated that unauthenticated requests can trigger the attack before any application code executes.\r\n\r\n### Solution\r\nRefer to the Vendor Information section below for newly patched versions of PHP that remediate these vulnerabilities. All PHP users are strongly encouraged to update immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Source downloads are available on the official PHP release page at php.net/downloads.\r\n\r\nLinux users are advised to check with their distribution vendor for updated packages, as many distributions received patches in advance. For PHP 8.1 and older versions that no longer receive official updates from the PHP project, contact your LTS vendor for backported fixes or upgrade to a supported version. The PHP security team has provided limited source backports for PHP 7.4, PHP 8.0, and PHP 8.1 to assist users building from source or without access to an LTS vendor.\r\n\r\nIf immediate patching is not feasible, the following temporary mitigation measures may reduce exposure to specific attack paths, though they do not provide complete protection. Because these vulnerabilities are closely related, mitigations for both CVEs should be applied:\r\n\r\n**For CVE-2026-109618 (OOM Corruption):**\r\n\r\n*  Set `memory_limit=-1` at an administrative level so it cannot be overridden by applications, for example via `php_admin_value` in the FPM pool or Apache configuration.\r\n* Set a low `post_max_size` (8M for applications without file uploads, 32M if uploads are necessary).\r\n* Keep `upload_max_filesize` below `post_max_size`.\r\n* Enforce limits at the web server or proxy level for decoded request-body size, input variable count, multipart part count, header count, and nesting depth.\r\n* Use container or cgroup limits as an availability boundary with policies that kill only the affected worker. Notably, `RLIMIT_AS` or `RLIMIT_DATA` should *not* be used to bound memory, as these cause `mmap()` to fail once the limit is reached, triggering the vulnerable code path rather than preventing it. \r\n\r\n**For CVE-2026-109619 (Stale Global State):**\r\n\r\n* Set `session.upload_progress.enabled=0` in php.ini, FPM pool, or server configuration and restart all workers.\r\n* On PHP 8.5, set `fatal_error_backtraces=0` and restart all workers.\r\n* Remove invalid or deprecated settings applied per request that emit diagnostics before initialization.\r\n* Remediate attacker-reachable fatal errors and execution timeouts.\r\n\r\nSystem owners can limit the potential impact of successful exploitation by implementing network segmentation and ensuring that PHP installations are configured to run with minimum necessary privileges. Users are advised to monitor closely for unusual PHP process behavior or unexpected memory allocation patterns.\r\n\r\n### Acknowledgements\r\nThanks to OpenAI, Wiz, and Ryan at Calif.io for reporting these vulnerabilities. This document was written by Molly Jaconski.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"Fixes for the two CVEs will be released as soon as possible","title":"Vendor statment from SUSE Linux"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/763488"},{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","summary":"https://www.php.net/archive/2026.php#2026-10-21-5"},{"url":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","summary":"https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"},{"url":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","summary":"https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"},{"url":"https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/","summary":"https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching","summary":"https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching"},{"url":"https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_a.md","summary":"https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_a.md"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2026/va-26-295-01.json","summary":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/IT/white/2026/va-26-295-01.json"},{"url":"https://www.php.net/archive/2026.php#2026-10-21-5","summary":"Reference(s) from vendor \"The PHP Group\""}],"title":"Memory corruption vulnerabilities in PHP","tracking":{"current_release_date":"2026-10-22T22:37:36+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.51"}},"id":"VU#763488","initial_release_date":"2026-10-22 22:23:50.819336+00:00","revision_history":[{"date":"2026-10-22T22:37:36+00:00","number":"1.20261022223736.4","summary":"Released on 2026-10-22T22:37:36+00:00"}],"status":"final","version":"1.20261022223736.4"}},"vulnerabilities":[{"title":"RCE via stale global state.","notes":[{"category":"summary","text":"RCE via stale global state. Affected versions < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12. For additional details see VINCE-NT Case#368200."}],"cve":"CVE-2026-109619","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#763488"}],"product_status":{"known_affected":["CSAFPID-5d4b612c-ce7b-11f1-a136-02ffc62a8117","CSAFPID-5d4b7da6-ce7b-11f1-a136-02ffc62a8117"]}},{"title":"RCE via OOM corruption.","notes":[{"category":"summary","text":"RCE via OOM corruption. Affected versions: < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12. For additional details see VINCE-NT Case#368200."}],"cve":"CVE-2026-109618","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#763488"}],"product_status":{"known_affected":["CSAFPID-5d4baf42-ce7b-11f1-a136-02ffc62a8117","CSAFPID-5d4bcd56-ce7b-11f1-a136-02ffc62a8117"]}}],"product_tree":{"branches":[{"category":"vendor","name":"The PHP Group","product":{"name":"The PHP Group Products","product_id":"CSAFPID-5d4b612c-ce7b-11f1-a136-02ffc62a8117"}},{"category":"vendor","name":"SUSE Linux","product":{"name":"SUSE Linux Products","product_id":"CSAFPID-5d4b7da6-ce7b-11f1-a136-02ffc62a8117"}},{"category":"vendor","name":"The PHP Group","product":{"name":"The PHP Group Products","product_id":"CSAFPID-5d4baf42-ce7b-11f1-a136-02ffc62a8117"}},{"category":"vendor","name":"SUSE Linux","product":{"name":"SUSE Linux Products","product_id":"CSAFPID-5d4bcd56-ce7b-11f1-a136-02ffc62a8117"}}]}}