Comment

Comment on

There are two CVE’s (CVE-2026-109618, CVE-2026-109619), both with a rating of 9.2 out of 10. They allow unauthenticated code execution.

From the phpfoundation website:

CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP’s memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.

source

Sort:hotnew top

INeedMana@piefed.zip ⁨4⁩ ⁨days⁩ ago
Yes, but from the page I linked

One really amusing thing in common with most of these “PoC"s is that they lean on “LFI”, or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

It’s not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

For sure that this is still a bug that should be patched. But I do remember “don’t eval on user sent stuff” rule. Or is this really prevalent in PHP ecosystem?

source
- i_am_not_a_robot@discuss.tchncs.de ⁨4⁩ ⁨days⁩ ago
  Those PoCs are fake. You can exploit a page that just prints “hello.”
  
  source
- realitaetsverlust@piefed.zip ⁨3⁩ ⁨days⁩ ago
  
  Or is this really prevalent in PHP ecosystem?
  
  Not anymore.
  
  You used to see eval a TON in like the early days, with like PHP 4 and 5. People just weren’t very experienced and PHP in itself had it’s limitations, and people worked around those by utilizing eval.
  
  But modern PHP code rarely ever uses eval. Modern toolings like PHPMD even flag eval as an error, causing it to fail a pipeline if used in one. If you find eval in a codebase today, it’s either a badly modernized legacy one or written by a retard.
  
  source
- phoenixz@lemmy.ca ⁨3⁩ ⁨days⁩ ago
  Dont use eval, period
  
  If you use eval, you’re doing it wrong
  
  source
  - INeedMana@piefed.zip ⁨3⁩ ⁨days⁩ ago
    That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval
    
    source