VORANT. Threat Intelligence Research Create a free account

PHP patches two unauthenticated RCE flaws

routine vulnerability Technology

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

Two critical use-after-free bugs let attackers remotely execute code on any PHP server handling web requests without authentication.

NCSC-NL issued a high-priority advisory for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both use-after-free issues that can be exploited remotely without authentication via ordinary web requests to achieve arbitrary code execution. CVE-2026-109618 involves memory corruption during out-of-memory handling, where internal request data may be only partially initialized yet still treated as valid during processing. CVE-2026-109619 arises from stale internal global state persisting after associated memory is freed; a subsequent request handled by the same worker can use this stale state before reinitialization, also leading to RCE.

All PHP installations that process web requests are affected, making this a broad-impact issue across web infrastructure. The PHP project has urged immediate updates and released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For unsupported branches (7.4, 8.0, 8.1), minimal source patches have been made available given the severity, though these are not regularly maintained. Temporary mitigations exist for both flaws but only restrict specific attack paths rather than fully resolving the issues; only applying the official update fully remediates the vulnerabilities.

Defenders should prioritize patching all PHP deployments immediately, including those on Linux distributions and LTS branches via vendor-supplied updates. No in-the-wild exploitation is mentioned in the advisory, but the unauthenticated, remote, pre-auth nature of both flaws combined with the ubiquity of PHP in web-facing infrastructure warrants urgent action.

Mentioned in this report

Vulnerabilities CVE-2026-109618CVE-2026-109619

Related reporting

Detection guidance

PHP or Web Server Worker Spawning Shell With Reverse-Shell or Download-and-Execute Command

ATT&CK T1190

A PHP/web server worker (php-fpm, php-cgi, mod_php under apache2/httpd) spawns a shell with reverse-shell or download-and-execute arguments, which is the likely post-exploitation outcome of unauthenticated PHP RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP or Web Server Worker Spawning Shell With Reverse-Shell or Download-and-Execute
  Command
description: Detects a PHP or web server worker process (php-fpm, php-cgi, apache2/httpd
  with mod_php) spawning a shell whose command line carries reverse-shell or download-and-execute
  patterns. Expected post-exploitation behaviour of unauthenticated PHP RCE flaws
  such as use-after-free bugs. Does not depend on any specific CVE or payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - php-fpm
    - php-cgi
  selection_parent_httpd:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /php
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_revshell:
    CommandLine|contains:
    - /dev/tcp/
    - bash -i
    - mkfifo
    - nc -e
    - ncat -e
    - nc.traditional -e
  selection_dl_tool:
    CommandLine|contains:
    - 'curl '
    - 'wget '
  selection_dl_exec:
    CommandLine|contains:
    - '| sh'
    - '| bash'
    - '|sh'
    - '|bash'
    - /tmp/
    - /dev/shm/
  condition: (1 of selection_parent*) and selection_child and (selection_revshell
    or (selection_dl_tool and selection_dl_exec))
falsepositives:
- Web applications or admin panels that legitimately shell out to curl/wget and write
  to /tmp as part of update or install routines
- Authorised penetration testing against PHP hosts
level: high
id: 3986533d-a4e6-5215-ade5-5c0847354b63
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0443.html

PHP Process Spawning Windows Shell With Reconnaissance or Payload Download Commands

ATT&CK T1190

php-cgi.exe, php.exe or httpd.exe spawns cmd/PowerShell with recon, encoded or download-cradle arguments, consistent with exploitation of a PHP RCE flaw on Windows. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP Process Spawning Windows Shell With Reconnaissance or Payload Download
  Commands
description: Detects PHP or Apache worker processes on Windows spawning cmd.exe or
  PowerShell with discovery commands, encoded commands or download cradles. Behavioural
  indicator of successful remote code execution via a PHP vulnerability.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php-win.exe
    - \php.exe
    - \httpd.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - certutil
    - bitsadmin
    - '-enc '
    - -encodedcommand
    - downloadstring
    - downloadfile
    - Invoke-WebRequest
    - 'iwr '
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Administrators running diagnostic scripts through a PHP-based management panel
- Authorised penetration testing against PHP hosts
level: high
id: 3869f2bc-c4c4-5447-ad48-3dbd8a31051d
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0443.html

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0443.html

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 13,820 reports from 143 sources, 505 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs