# PHP patches two pre-auth RCE flaws

Published: 2026-10-21 · Severity: elevated · Sectors: Technology, Government (National)
Canonical: https://vorant.io/reports/b0fb85cb-d69f-51c0-8a51-b73c713e4e22/php-patches-two-pre-auth-rce-flaws

> Two PHP memory-corruption bugs allow unauthenticated remote code execution in web-facing PHP services; no known exploitation yet but it's expected soon.

CIS/MS-ISAC issued an advisory covering two vulnerabilities in PHP affecting all installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. CVE-2026-109618 is a remote-code-execution flaw triggered by out-of-memory handling that interrupts PHP mid-request, leaving partially initialized data that is later treated as valid during cleanup. CVE-2026-109619 arises from stale global state: request-owned internal memory can persist after being freed and be reused by a later request on the same worker before proper initialization resets it. Both could allow unauthenticated remote code execution in the context of the PHP service account, with impact scaling to the privileges of that account.

Affected versions are PHP prior to 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with versions 8.1 and earlier also impacted if serving web requests. There are no current reports of in-the-wild exploitation, but the advisory assesses high risk that exploits will appear quickly given the pre-auth RCE nature of the flaws and PHP's broad deployment footprint.

Defenders should prioritize upgrading to the fixed branches or applying distro/LTS vendor patches. Where immediate patching isn't possible, interim mitigations are offered for each CVE: removing finite memory limits (via php_admin_value) and constraining post/upload sizes and request complexity for CVE-2026-109618; disabling session.upload_progress and (on PHP 8.5) fatal_error_backtraces, with full worker restarts, for CVE-2026-109619. These are partial measures only — full remediation requires updating PHP. Running PHP service accounts with least privilege reduces the blast radius if exploited.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618, CVE-2026-109619

## Detection guidance (public sample)

### PHP or Web Server Worker Spawning Shell With Recon or Reverse-Shell Commands (Linux)

ATT&CK: T1190

A PHP handler or web server process (php-fpm, php-cgi, lsphp, FrankenPHP, Apache mod_php) spawns a shell or recon/network tool with post-exploitation arguments, as expected after pre-auth PHP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP or Web Server Worker Spawning Shell With Recon or Reverse-Shell Commands
  (Linux)
description: Detects PHP handlers or web server workers (php-fpm, php-cgi, lsphp,
  FrankenPHP, Apache/httpd mod_php) spawning a shell with recon, download-and-execute
  or reverse-shell arguments, or launching recon/netcat tools directly. Expected post-exploitation
  behaviour after unauthenticated PHP RCE such as CVE-2026-109618 and CVE-2026-109619.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - php-fpm
    - lsphp
    - frankenphp
    ParentImage|endswith:
    - /php-cgi
    - /apache2
    - /httpd
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    CommandLine|contains:
    - whoami
    - uname -a
    - /etc/passwd
    - /dev/tcp/
    - bash -i
    - curl http
    - wget http
    - base64 -d
    - nc -e
    - mkfifo
  selection_tools:
    Image|endswith:
    - /whoami
    - /nc
    - /ncat
    - /socat
  condition: selection_parent and (selection_shell or selection_tools)
falsepositives:
- PHP applications that legitimately shell out to run curl or wget with an explicit
  URL, such as update or backup scripts
- Administrative web panels that run system information commands
level: medium
id: 07a0f623-a259-57b9-9642-2dcdb540fb0c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-remote-code-execution_2026-119
```

### PHP or Web Server Process Spawning Command Interpreter With Recon or Download Commands (Windows)

ATT&CK: T1190

php-cgi, php, Apache httpd, FrankenPHP or IIS w3wp spawning cmd/PowerShell with recon or download-cradle arguments, or recon binaries directly, indicating post-exploitation of a PHP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP or Web Server Process Spawning Command Interpreter With Recon or Download
  Commands (Windows)
description: Detects PHP handlers or web server processes on Windows (php-cgi, php,
  php-win, httpd, FrankenPHP, w3wp) spawning cmd/PowerShell with reconnaissance, encoded
  or download-cradle arguments, or running recon binaries directly. Typical follow-on
  activity after unauthenticated PHP RCE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php-win.exe
    - \php.exe
    - \httpd.exe
    - \frankenphp.exe
    - \w3wp.exe
  selection_shell:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - systeminfo
    - ipconfig /all
    - certutil
    - bitsadmin
    - DownloadString
    - Invoke-WebRequest
    - ' -enc'
    - FromBase64String
  selection_tools:
    Image|endswith:
    - \whoami.exe
    - \systeminfo.exe
    - \nltest.exe
    - \certutil.exe
  condition: selection_parent and (selection_shell or selection_tools)
falsepositives:
- Web-based administration panels or deployment scripts that call systeminfo or ipconfig
  via PHP
- IIS applications that legitimately invoke PowerShell for management tasks
level: medium
id: e7381778-1f5e-5704-92bd-ccfb9f3b68d4
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-remote-code-execution_2026-119
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-remote-code-execution_2026-119

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b0fb85cb-d69f-51c0-8a51-b73c713e4e22/php-patches-two-pre-auth-rce-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup