PHP patches two pre-auth RCE flaws

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

Two PHP memory-corruption bugs allow unauthenticated remote code execution in web-facing PHP services; no known exploitation yet but it's expected soon.

CIS/MS-ISAC issued an advisory covering two vulnerabilities in PHP affecting all installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. CVE-2026-109618 is a remote-code-execution flaw triggered by out-of-memory handling that interrupts PHP mid-request, leaving partially initialized data that is later treated as valid during cleanup. CVE-2026-109619 arises from stale global state: request-owned internal memory can persist after being freed and be reused by a later request on the same worker before proper initialization resets it. Both could allow unauthenticated remote code execution in the context of the PHP service account, with impact scaling to the privileges of that account.

Affected versions are PHP prior to 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with versions 8.1 and earlier also impacted if serving web requests. There are no current reports of in-the-wild exploitation, but the advisory assesses high risk that exploits will appear quickly given the pre-auth RCE nature of the flaws and PHP's broad deployment footprint.

Defenders should prioritize upgrading to the fixed branches or applying distro/LTS vendor patches. Where immediate patching isn't possible, interim mitigations are offered for each CVE: removing finite memory limits (via php_admin_value) and constraining post/upload sizes and request complexity for CVE-2026-109618; disabling session.upload_progress and (on PHP 8.5) fatal_error_backtraces, with full worker restarts, for CVE-2026-109619. These are partial measures only — full remediation requires updating PHP. Running PHP service accounts with least privilege reduces the blast radius if exploited.

title: PHP or Web Server Worker Spawning Shell With Recon or Reverse-Shell Commands
  (Linux)
description: Detects PHP handlers or web server workers (php-fpm, php-cgi, lsphp,
  FrankenPHP, Apache/httpd mod_php) spawning a shell with recon, download-and-execute
  or reverse-shell arguments, or launching recon/netcat tools directly. Expected post-exploitation
  behaviour after unauthenticated PHP RCE such as CVE-2026-109618 and CVE-2026-109619.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - php-fpm
    - lsphp
    - frankenphp
    ParentImage|endswith:
    - /php-cgi
    - /apache2
    - /httpd
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains:
    - whoami
    - uname -a
    - /etc/passwd
    - /dev/tcp/
    - bash -i
    - curl http
    - wget http
    - base64 -d
    - nc -e
    - mkfifo
  selection_tools:
    Image|endswith:
    - /whoami
    - /nc
    - /ncat
    - /socat
  condition: selection_parent and (selection_shell or selection_tools)
falsepositives:
- PHP applications that legitimately shell out to run curl or wget with an explicit
  URL, such as update or backup scripts
- Administrative web panels that run system information commands
level: medium
id: 07a0f623-a259-57b9-9642-2dcdb540fb0c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-remote-code-execution_2026-119

title: PHP or Web Server Process Spawning Command Interpreter With Recon or Download
  Commands (Windows)
description: Detects PHP handlers or web server processes on Windows (php-cgi, php,
  php-win, httpd, FrankenPHP, w3wp) spawning cmd/PowerShell with reconnaissance, encoded
  or download-cradle arguments, or running recon binaries directly. Typical follow-on
  activity after unauthenticated PHP RCE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php-win.exe
    - \php.exe
    - \httpd.exe
    - \frankenphp.exe
    - \w3wp.exe
  selection_shell:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - systeminfo
    - ipconfig /all
    - certutil
    - bitsadmin
    - DownloadString
    - Invoke-WebRequest
    - ' -enc'
    - FromBase64String
  selection_tools:
    Image|endswith:
    - \whoami.exe
    - \systeminfo.exe
    - \nltest.exe
    - \certutil.exe
  condition: selection_parent and (selection_shell or selection_tools)
falsepositives:
- Web-based administration panels or deployment scripts that call systeminfo or ipconfig
  via PHP
- IIS applications that legitimately invoke PowerShell for management tasks
level: medium
id: e7381778-1f5e-5704-92bd-ccfb9f3b68d4
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-remote-code-execution_2026-119

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-remote-code-execution_2026-119