Summarize this Threat Intelligence with AI:
Ask ChatGPT
Ask Grok
Ask Perplexity
Ask Claude
Ask Google AISummary of PHP Remote Code Execution 2026
| Vulnerability Name | PHP Remote Code Execution (CVE-2026-109618/CVE-2026-109619) |
| Released on | October 22, 2026 |
| Affected Component | PHP |
| Affected Version | 8.2.x <= PHP < 8.2.35 8.3.x <= PHP < 8.3.36 8.4.x <= PHP < 8.4.27 8.5.x <= PHP < 8.5.12 |
| Vulnerability Type | Code execution |
| Exploitation Condition | 1. User authentication: not required. 2. Prerequisites: default configurations. 3. Trigger mode: remote. |
| Impact | Exploitation difficulty: The vulnerability can be triggered easily. Full code execution depends on the target runtime environment configuration. Severity: critical. Successful exploitation can lead to remote code execution. |
| Official Solution | Available |
About the Vulnerability
Component Introduction
PHP (Hypertext Preprocessor) is a server-side scripting language particularly suitable for web development and can be embedded in HTML. PHP syntax draws on C, develops its own distinctive syntax by combining features from multiple languages such as Java and Perl, and continuously improves itself based on the strengths of these languages, for example, Java's object-oriented programming. The primary goal of PHP when it was originally created was to enable developers to quickly write high-quality websites. PHP supports both object-oriented and procedural development, and is very flexible to use.
Vulnerability Description
On October 21, 2026, Sangfor FarSight Labs received notification of the code execution vulnerability in PHP (CVE-2026-109618/CVE-2026-109619), classified as critical in threat level.
PHP's session upload progress mechanism (session.upload_progress) contains two pre-authentication remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. By crafting specially designed file upload requests, an attacker can exploit flaws in the mechanism that manifest when memory is abnormally exhausted and process state is not fully reset, thereby triggering a use-after-free. The attacker first leaks process memory addresses to bypass address space layout randomization (ASLR), and then hijacks the program execution flow to execute arbitrary commands with web service privileges and to bypass disable_functions. In addition, the mechanism writes the attacker-specified session ID and upload filename into the session file without filtering, which can further trigger deserialization-based code execution on sites with specific configurations. The attack does not require any flaw in the target application, as any PHP page is within the attack surface. The affected versions range from PHP 5.4 to PHP 8.5.11 when default configurations are used, and mainstream applications such as WordPress are all affected.
Vulnerability Reproduction
The vulnerability reproduction test produced the following results:mod_php
A self-built Docker test environment was set up with Apache 2.4 and PHP 8.4.26. The environment used mod_php with the prefork MPM and was configured with MaxRequestWorkers=1 (a single worker). The php.ini configurations were as follows:
memory_limit=8M
post_max_size=64M
upload_max_filesize=64M
session.upload_progress.enabled=On
session.use_strict_mode=0
session.use_cookies=1
The target was a 28-byte stub page at /wp-content/index.php within a WordPress installation. The command payload was limited to 14 bytes or fewer, and the exploit succeeded after multiple retry attempts. The results are shown below:
The exploitation requirements for these remote code execution vulnerabilities are relatively stringent. Whether they have a generic exploitation chain is still under continuous research by Sangfor FarSight Labs.
Affected Versions
The following PHP versions are affected:
- 8.2.x <= PHP < 8.2.35
- 8.3.x <= PHP < 8.3.36
- 8.4.x <= PHP < 8.4.27
- 8.5.x <= PHP < 8.5.12
Solutions
Remediation Solutions
Official Solution
The following patched versions have been officially released: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. Affected users are advised to promptly upgrade to the corresponding patched version.
Download link: https://www.php.net/downloads.php
Workarounds
CVE-2026-109618:
- At the FPM pool or server configuration level, remove the per-request PHP memory limit (memory_limit=-1), and check whether any pool, directory, or application configuration overrides this setting.
- Set post_max_size to a conservative value, and separately limit the decoded request body size at the reverse proxy/WAF layer.
- Tighten limits on the input nesting depth, number of variables, number of multipart segments, number of headers per segment, and number of uploaded files.
- Container/cgroup memory limits can be used as an additional safeguard. However, do not use RLIMIT_AS/RLIMIT_DATA.
CVE-2026-109619:
- Set session.upload_progress.enabled=0 in php.ini or the FPM pool configuration, and restart all workers.
- For PHP 8.5, set fatal_error_backtraces=0.
- Reduce the number of fatal errors and predictable timeout trigger points that attackers can reach.
- When performance permits, set pm.max_requests=1 to prevent state from persisting across requests.
Sangfor Solutions
Risk Asset Discovery
The following Sangfor service can proactively detect CVE-2026-109618/CVE-2026-109619 vulnerabilities and quickly identify affected assets in batches in business scenarios:
- Sangfor Athena Endpoint Protection Platform (EPP): The corresponding asset discovery solution has been released. The fingerprint ID is 0006509.
Proactive Vulnerability Detection
The following Sangfor services can proactively detect CVE-2026-109618/CVE-2026-109619 vulnerabilities and quickly identify vulnerability risks in batches in business scenarios:
- Sangfor Athena EPP: The corresponding detection solution will be released on October 23, 2026. The rule ID is d44148de32f847b392685c4c25cd2abe.
- Sangfor Athena Extended Detection and Response (XDR): The corresponding detection solution will be released on October 22, 2026. The rule ID is SF-0005-22845.
Vulnerability Monitoring
The following Sangfor services support CVE-2026-109618/CVE-2026-109619 vulnerability monitoring, and can quickly identify affected assets and the impact scope in business scenarios in real time through traffic collection:
- Sangfor Athena Network Detection and Response (NDR): The corresponding monitoring solution will be released on October 22, 2026. The rule ID is 11224850.
- Sangfor Athena Managed Detection and Response (MDR): The corresponding monitoring solution will be released on October 22, 2026. The rule ID is 11224850. In this case, make sure that Athena MDR is integrated with Athena NDR.
- Sangfor Athena XDR: The corresponding monitoring solution will be released on October 22, 2026. The rule ID is 11224850.
Vulnerability Prevention
The following Sangfor services can effectively block CVE-2026-109618/CVE-2026-109619 exploits:
- Sangfor Athena Next-Generation Firewall (NGFW): The corresponding prevention solution will be released on October 22, 2026. The rule ID is 11224850.
- Sangfor Web Application Firewall (WAF): The corresponding prevention solution will be released on October 22, 2026. The rule ID is 11224850.
- Sangfor Athena MDR: The corresponding prevention solution will be released on October 22, 2026. The rule ID is 11224850. In this case, make sure that Athena MDR is integrated with Athena NGFW.
- Sangfor Athena XDR: The corresponding prevention solution will be released on October 22, 2026. The rule ID is 11224850. In this case, make sure that Athena MDR is integrated with Athena NGFW.
Timeline
On October 22, 2026, Sangfor FarSight Labs received notification of the remote code execution vulnerability in PHP (CVE-2026-109618/CVE-2026-109619).
On October 22, 2026, Sangfor FarSight Labs released a vulnerability alert.
Reference
1. https://www.php.net/archive/2026.php#2026-10-20-1
2. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
3. https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
