PHP patches unauthenticated RCE flaws
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
Two memory-corruption bugs in PHP before 8.2.35/8.3.36/8.4.27/8.5.12 allow unauthenticated remote code execution via crafted HTTP requests, with PoC exploitation demonstrated.
CERT/CC published VU#763488 describing two related memory-safety vulnerabilities in PHP: CVE-2026-109618, an out-of-memory handling flaw where cleanup routines access partially-initialized request data after an OOM condition, and CVE-2026-109619, a use-after-free in global state management where a worker process retains a stale reference to freed request data that can be accessed by a subsequent request on the same worker. Both can be triggered remotely and unauthenticated via specially crafted HTTP requests against any PHP deployment model (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed), potentially leading to arbitrary code execution and full compromise of confidentiality, integrity, and availability of the web service and underlying host.
Apache mod_php deployments are called out as particularly high-risk because proof-of-concept exploitation has shown unauthenticated requests can trigger the vulnerable code path before any application code runs, meaning the application layer provides no protection. The issues affect all PHP branches prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12; vendors including the PHP project, NSA, and CISA have issued urgent advisories recommending immediate patching. PHP 7.4, 8.0, and 8.1 are end-of-life but have received limited source backports.
Defenders should prioritize upgrading to the fixed PHP versions immediately, checking with Linux distribution vendors for backported packages. Where immediate patching isn't possible, CERT/CC lists detailed interim mitigations for each CVE: for CVE-2026-109618, lock memory_limit administratively, cap post_max_size/upload_max_filesize, enforce request-size and header/nesting limits at the web server or proxy, and use cgroup limits that kill only the affected worker (avoiding RLIMIT_AS/RLIMIT_DATA, which can trigger the bug rather than prevent it); for CVE-2026-109619, disable session.upload_progress, disable fatal_error_backtraces on PHP 8.5, and remediate attacker-reachable fatal errors. Network segmentation, least-privilege PHP process configuration, and monitoring for unusual PHP process behavior or memory allocation anomalies are also recommended.
Mentioned in this report
Detection guidance
PHP or Web Server Worker Spawning Shell With Reverse-Shell or Download Patterns on Linux
A PHP worker (php-fpm, php-cgi, FrankenPHP) or Apache/LiteSpeed process spawns a shell with reverse-shell, download-and-execute or decode-and-execute arguments. This is the likely post-exploitation step after remote code execution through a PHP memory-safety flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP or Web Server Worker Spawning Shell With Reverse-Shell or Download Patterns
on Linux
description: Detects PHP workers or web server processes (php-fpm, php-cgi, frankenphp,
apache2/httpd, litespeed) spawning a shell whose command line contains reverse-shell,
download-and-execute or decode-and-execute patterns. Typical post-exploitation after
unauthenticated RCE in a PHP deployment.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /frankenphp
- /apache2
- /httpd
- /lshttpd
- /litespeed
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- /dev/tcp/
- nc -e
- ncat -e
- base64 -d
- curl http
- wget http
- socat exec
- chmod +x /tmp
- chmod 777 /tmp
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications that legitimately shell out to curl or wget to fetch remote content
- Deployment or admin panels running download scripts from the web server user
level: high
id: 112ef5ff-bd0e-5c04-8814-1b1b2cab876b
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/763488
PHP or Web Server Worker Spawning Reconnaissance Tools on Linux
A PHP or web server worker directly executes identity or network reconnaissance binaries, which is rare in normal application behaviour and typical after exploiting a PHP RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP or Web Server Worker Spawning Reconnaissance Tools on Linux
description: Detects php-fpm, php-cgi, FrankenPHP or Apache/LiteSpeed processes executing
identity, network or privilege reconnaissance binaries such as whoami, id, ifconfig,
netstat or nc. Indicates possible post-exploitation after remote code execution
in PHP.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1033
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /frankenphp
- /apache2
- /httpd
- /lshttpd
- /litespeed
selection_child:
Image|endswith:
- /whoami
- /id
- /ifconfig
- /netstat
- /nc
- /ncat
- /socat
condition: selection_parent and selection_child
falsepositives:
- Server-monitoring or diagnostic PHP scripts that call id or netstat
- Hosting control panels that run PHP-based system checks
level: medium
id: 344cb149-b0fa-5a5d-b484-405c1f2169ff
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/763488
PHP-CGI or Apache Spawning Command Interpreter or LOLBin on Windows
php-cgi.exe or the Apache httpd.exe process spawns cmd, PowerShell or a download/recon LOLBin, consistent with code execution through a PHP web exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP-CGI or Apache Spawning Command Interpreter or LOLBin on Windows
description: Detects php-cgi.exe or Apache httpd.exe spawning cmd.exe, PowerShell,
or common download and recon LOLBins. Indicates possible post-exploitation after
unauthenticated RCE in a PHP deployment on Windows.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \php-cgi.exe
- \httpd.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \whoami.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
- \net.exe
- \net1.exe
condition: selection
falsepositives:
- PHP applications on Windows that deliberately call cmd.exe through exec or system
- Apache-hosted admin tools that run net.exe or whoami for diagnostics
level: medium
id: bbd6d3e0-0ae2-5ad3-8c2c-43c5a6188ec4
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/763488
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/763488
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,001 reports from 143 sources, 540 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs