PHP
4 articles with this tag
What to check after an emergency PHP update: web PHP vs command-line PHP, set -e and diff exit codes, and an intrusion re-check
During the October 2026 response to the critical PHP vulnerabilities, a site this site's operator runs had updated the web PHP, but the command-line PHP used by cron still pointed to an old version. Check web and CLI separately. With set -e, diff and grep return exit status 1 for 'differences found' or 'no match', which stops the script; handle 0, 1 and 2 separately. After patching, run the same intrusion checklist on every server, and settle a suspicious log entry by comparing live files with the known-good deployed copy.
Linux kernel Fragnesia (CVE-2026-46300): CISA lists it as exploited with a Oct 31 deadline; patch PHP and the kernel, then reboot
CVE-2026-46300, nicknamed Fragnesia, is a flaw in the Linux kernel that lets a low-privileged local user gain root (CVSS v3.1 7.8, local attack vector). When the kernel moves data fragments between network buffers it can lose a marker that says the data is shared with a file in memory, and the IPsec ESP code can then decrypt over the cached copy of a read-only file. The kernel project published the CVE on May 23, 2026, and fixes are in kernel 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10 and later. On October 28, 2026 (US time) CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on evidence of active exploitation, with a due date of October 31 for US federal agencies. CISA's description says it can be chained with the PHP flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. A security company reported that this chain was used against 25 servers (mostly firewalls), and SecurityWeek repeated the report; this site has not independently verified the numbers. Ubuntu, Red Hat and Debian have shipped fixed kernels, and a kernel update takes effect only after a reboot. This site's conclusion: if you run PHP sites on Linux, update PHP and the kernel, reboot, and check for webshells.
[Breaking] PHP flaws CVE-2026-109618 and CVE-2026-109619 now exploited, added to CISA's KEV catalog: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now
On October 21, 2026, the PHP security team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can allow unauthenticated remote code execution (RCE), and urged all users to update immediately. CVE-2026-109618 involves out-of-memory handling and CVE-2026-109619 involves stale internal state surviving between requests; both are rated 9.2 under CVSS v4.0. All PHP installations serving web requests are at risk (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). The team considers mod_php the highest risk, citing a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. PHP 8.1 and older get no official update; the team provided minimal source backports for 7.4, 8.0 and 8.1. Linux distributions received the patches in advance. There is no complete mitigation; updating is the only safe choice. On October 22, Japan's IPA and JPCERT/CC issued alerts and JVN published JVNVU#99905564. CISA, which had not observed exploitation when it first published its alert, added both flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 26, with an October 29 deadline for US federal civilian agencies. According to media reports, a security researcher's honeypots running unpatched PHP 8.4.26 under mod_php saw successful remote code execution on October 24. A major cloud provider's honeypots had seen exploitation attempts from October 17, four days before disclosure. As far as this site could find, no break-in outside honeypots had been made public as of October 27. Most major Japanese shared-hosting providers have announced that the fix is applied, but some, such as KAGOYA, have not. On October 23, the PHP team disclosed a third issue (CVE-2026-115560) that the October 21 releases do not fix. It can lead to code execution only under a specific combination of configuration and application code; the team calls it unlikely in practice, will ship the fix and a full advisory with the next regular release, and recommends setting session.upload_progress.enabled=0 until then. Affected versions and a CVSS score have not been published, and no exploitation has been reported. As of October 29 (checked on php.net), no fixed release for this issue was out. On October 28, CISA also added the Linux kernel flaw CVE-2026-46300 to KEV (October 31 deadline for US federal agencies) and said it can be chained with these two flaws to implant PHP webshells and run commands as root. This site's take: exploitation is now confirmed, so confirm whether you or your provider updates PHP for each site and move to the fixed version today. Also check logs from October 17 onward for signs of a break-in. On shared hosting, check your provider's completion notice on its official website.
CVE-2026-87902 — Unauthenticated file inclusion in WordPress core (conditional RCE): explainer and fix
Unauthenticated local file inclusion in WordPress core 4.7–7.1.1 (CWE-98), leading to RCE when theme and server conditions line up. Fixed 22 September (7.1.2 and every branch back to 4.7); CISA added it to KEV on 25 September. This site's view: an EPSS of 3% does not matter once it is in KEV. Update, and also turn off PHP's register_argc_argv to remove the server-side condition RCE needs.