PHP Core Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619 )

The underlying mechanics reside within the low-level C request-handling architecture of the PHP interpreter engine. When an HTTP request reaches a server running PHP through Server Application Programming Interfaces (SAPIs) such as PHP-FPM, mod_php, or FastCGI, incoming POST requests with multipart/form-data encoding cause the core engine to initialise internal stream buffers and parse request boundaries before control transfers to the web application script.

The vulnerabilities centre on memory-handling and boundary-validation errors during this early parsing stage, specifically within the session upload progress tracking feature (session.upload_progress), which is enabled by default across standard distribution builds.

Because this parsing logic triggers during initial HTTP body processing, memory corruption occurs prior to the execution of any web application code. This pre-execution behaviour presents a significant hurdle for security defences, as application-level security controls, embedded Web Application Firewalls (WAFs), and framework security modules do not run until parsing completes. If a malicious request triggers memory corruption during C-level stream parsing, the runtime process is compromised or crashes before application code can inspect or sanitise the input.

Exploitation requires no prior authentication or active session, allowing attackers to target any valid HTTP POST endpoint on an exposed server—even routes that do not accept file uploads. The underlying multipart parser handles incoming stream attributes before verifying whether the target script contains file-handling logic. Additionally, analysing binary patch diffs enables threat actors to quickly isolate modified C structures within the parsing module, accelerating the development of weaponised exploits.

Exploitation Mechanics

Successful exploitation grants an attacker arbitrary code execution within the security context of the running PHP worker process. Depending on the host operating system and web server deployment model, this typically corresponds to unprivileged service accounts such as www-data, apache, nginx, or nobody.

When an exploit payload successfully manipulates low-level runtime memory structures, the underlying engine worker process can be forced to instantiate subshells or invoke system utilities directly.

Because unstable or malformed exploit payloads frequently trigger memory corruption faults, attack attempts generate distinct behavioural signals at both the host and process levels:

• Worker Process Crash Anomalies: A sudden rise in segmentation faults (SIGSEGV) logged within PHP-FPM or Apache process files, frequently correlating with a high volume of incoming HTTP POST requests specifying multipart form boundaries.
• Rapid Worker PID Cycling: Abnormal frequency of worker process crashes and immediate restarts within PHP-FPM pools as memory corruption attempts disrupt worker threads.
• Unusual Child Process Instantiation: Web service parent binaries (php-fpm, php-cgi, httpd, apache2) directly spawning command interpreters (sh, bash, cmd.exe, powershell.exe) or network retrieval utilities (curl, wget, certutil).
  

Vulnerable Versions and Upstream Patch Matrix

The security vulnerabilities impact all major PHP runtime releases from version 5.4.0 through modern 8.x branches. Upstream security maintenance is provided exclusively for currently supported major branches, specifically PHP 8.2, 8.3, 8.4, and 8.5. End-of-Life (EOL) versions will not receive official security patches from the PHP Development Team. Organisations maintaining legacy environments must rely on infrastructure isolation, web proxy filtering, or backported security packages provided by enterprise Linux distribution vendors.

‍

Recommendations and Mitigations

• Core Engine Upgrades:
  • Upgrade active PHP runtimes to patched releases (8.2.35, 8.3.36, 8.4.27, or 8.5.12).
  • Critical Step: Fully restart all web server and worker processes (php-fpm, apache2, httpd) after updating system packages. Simply updating files on disk does not remove vulnerable code already loaded into active worker memory.
• Configuration Workaround :
  • If immediate updates cannot be deployed, disable the upload progress feature by setting session.upload_progress.enabled = Off in global configuration files (php.ini, FPM pool files via php_admin_value[session.upload_progress.enabled] = 0, or site-level .user.ini).
  • Important: Calling ini_set('session.upload_progress.enabled', 0) inside application code is ineffective because multipart request parsing occurs before application scripts execute. Reload or restart the web service so workers ingest the updated configuration.
    
• Edge Reverse Proxy & Route Filtering:
  • Configure upstream Web Application Firewalls (WAFs), reverse proxies, or load balancers (Nginx, Apache, HAProxy, Cloudflare, AWS/Azure WAF) to block incoming multipart/form-data POST requests on application routes that do not accept file uploads, or block requests containing the PHP_SESSION_UPLOAD_PROGRESS form field if upload progress tracking is unused.
  • Reduce the maximum allowable HTTP request body size (e.g., setting client_max_body_size in Nginx) to restrict the buffer size available for exploit delivery.
    

Threat Hunting and Detection

• Process Lineage & Telemetry Monitoring:
  • Monitor web server parent processes (php-fpm, php-cgi, apache2, httpd, frankenphp, caddy) for suspicious child process instantiation.
  • Command Shells: Alert on direct execution of /bin/sh, /bin/bash, cmd.exe, or powershell.exe.
  • Network Utilities: Flag calls to curl, wget, nc, ncat, or certutil.exe used to download external payloads.
  • Reconnaissance Tools: Detect unexpected invocation of whoami, id, uname, hostname, or ipconfig.
• Linux System Call Auditing (auditd):
  • Deploy kernel audit rules targeting the Effective User ID (eUID) assigned to web service accounts (e.g., UID 33 for www-data on Debian/Ubuntu systems).
  • This tracks command execution by web workers, including subshells executed via /bin/sh -c constructs.
• Web Access and Crash Log Analysis:
  • Traffic Anomalies: Search access logs for sudden surges of HTTP POST requests containing multipart/form-data headers directed toward non-upload endpoints or static files.
  • Segmentation Faults: Inspect /var/log/php-fpm.log or system logs for repeated SIGSEGV crash errors correlated with multipart POST traffic.
  • File Inspection: Audit temporary storage directories (/tmp, /var/tmp) and web root folders for newly created scripts or dropped webshells.