CVE-2026-109618 & CVE-2026-109619: PHP Memory Corruption Exploited in the Wild — Immediate Remediation and Detection Guide

---
title: PHP-FPM Process Spawning Shell or System Commands
id: 7c4f8a2e-1b3d-4e5f-9c6a-2d8e5f7a9b1c
status: experimental
description: Detects PHP-FPM worker processes spawning shell interpreters or system utilities, indicating potential post-exploitation activity following memory corruption.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/26
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-cgi'
      - '/php'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts executed via PHP
  - Monitoring agents with PHP-based health checks
level: high
---
title: Web Server Process Writing to Suspicious Directories
id: 9e2b6d4f-8c1a-4f5e-b7d3-1a9c4e6f8b2d
status: experimental
description: Detects web server processes (Apache, Nginx, IIS) writing executable files to temporary or world-writable directories, common in post-exploitation webshell deployment.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/10/26
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_user:
    User:
      - 'www-data'
      - 'apache'
      - 'nginx'
      - 'httpd'
  selection_path:
    TargetFilename|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  selection_extension:
    TargetFilename|endswith:
      - '.php'
      - '.sh'
      - '.py'
      - '.pl'
      - '.elf'
  condition: selection_user and selection_path and selection_extension
falsepositives:
  - Legitimate application caching mechanisms
  - PHP session file operations in /tmp
level: medium
---
title: Abnormal PHP Process Memory Allocation Failure
id: 3f8c1e5a-6b4d-4c2e-a9f7-5d3e8b1c6a4f
status: experimental
description: Detects repeated PHP-FPM worker crashes and restarts, potentially indicating exploitation attempts causing memory corruption and segmentation faults.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/10/26
tags:
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/php-fpm'
    CommandLine|contains: 'pool www'
  timeframe: 5m
  condition: selection | count() > 10
falsepositives:
  - High-traffic scenarios with aggressive process recycling
  - Misconfigured PHP-FPM max_requests settings
level: low

let timeRange = 24h;
let suspiciousCommands = dynamic(["/bin/sh", "/bin/bash", "nc", "netcat", "curl", "wget", "python", "perl", "base64"]);
union isfuzzy=true
    (SecurityEvent
    | where TimeGenerated > ago(timeRange)
    | where EventID == 4688
    | where ParentProcessName has_any ("php-fpm", "php-cgi", "httpd", "apache", "nginx")
    | where NewProcessName has_any (suspiciousCommands)
    | project TimeGenerated, Computer, ParentProcessName, NewProcessName, CommandLine, Account, Source = "SecurityEvent"),
    (Syslog
    | where TimeGenerated > ago(timeRange)
    | where Facility == "daemon" or Facility == "local0"
    | where SyslogMessage has "php-fpm" and SyslogMessage has_any ("segfault", "SIGSEGV", "crash", "memory corruption")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, Source = "Syslog"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(timeRange)
    | where InitiatingProcessFileName has_any ("php-fpm", "php-cgi", "php")
    | where FileName has_any (suspiciousCommands)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, Source = "DeviceProcessEvents"),
    (CommonSecurityLog
    | where TimeGenerated > ago(timeRange)
    | where DeviceProduct has "Apache" or DeviceProduct has "Nginx"
    | where Message has_any ("POST", "GET") and Message has_any (".php?", "eval(", "base64_decode", "system(", "exec(")
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, Message, Source = "WebLogs")
| order by TimeGenerated desc

-- Hunt for PHP exploitation indicators and webshell deployment
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       timestamp(epoch=CreateTime) AS ProcessStartTime,
       parent().Name AS ParentProcess,
       parent().Exe AS ParentExe
FROM pslist()
WHERE (Name =~ 'php' OR Exe =~ 'php')
  AND (parent().Name =~ 'httpd|apache|nginx|php-fpm|w3wp' 
       OR CommandLine =~ 'eval|base64_decode|shell_exec|system|passthru')
ORDER BY CreateTime DESC
LIMIT 100

-- Additional check: recently modified PHP files in web directories
SELECT FullPath, Size, Mtime, Ctime, Atime,
       timestamp(epoch=Mtime) AS ModifiedTime
FROM glob(globs=['/var/www/**/*.php', '/srv/www/**/*.php', 'C:/inetpub/**/*.php'])
WHERE Mtime > now() - 86400
  AND (FullPath =~ '/tmp/|/var/tmp/|uploads/|images/|cache/')
ORDER BY Mtime DESC

#!/bin/bash
# PHP CVE-2026-109618 & CVE-2026-109619 Detection and Remediation Script
# Author: Security Arsenal
# Date: 2026-10-26

set -euo pipefail

RED='\033[0;31m'
YELLOW='\033[1;33m'
GREEN='\033[0;32m'
NC='\033[0m' # No Color

echo "======================================"
echo "PHP Vulnerability Assessment Script"
echo "CVE-2026-109618 & CVE-2026-109619"
echo "======================================"
echo ""

# Function to compare version numbers
version_compare() {
    if [[ $1 == $2 ]]; then
        return 0
    fi
    local IFS=.
    local i ver1=($1) ver2=($2)
    for ((i=0; i<${#ver1[@]}; i++)); do
        if [[ -z ${ver2[i]} ]]; then
            ver2[i]=0
        fi
        if ((10#${ver1[i]} > 10#${ver2[i]})); then
            return 1
        fi
        if ((10#${ver1[i]} < 10#${ver2[i]})); then
            return 2
        fi
    done
    return 0
}

# Detect PHP installations
echo -e "${YELLOW}[*] Detecting PHP installations...${NC}"
PHP_BINARIES=$(which php php-fpm php-cgi 2>/dev/null || echo "")

if [ -z "$PHP_BINARIES" ]; then
    echo -e "${GREEN}[+] No PHP installations found in PATH${NC}"
else
    echo -e "${YELLOW}[!] Found PHP binaries:${NC}"
    echo "$PHP_BINARIES"
    echo ""
    
    for binary in $PHP_BINARIES; do
        echo "-----------------------------------"
        echo "Checking: $binary"
        
        # Get PHP version
        if PHP_VERSION=$($binary -v 2>/dev/null | head -n 1 | grep -oP 'PHP \K[0-9]+\.[0-9]+\.[0-9]+'); then
            echo "  Version: $PHP_VERSION"
            
            # Check if version is potentially vulnerable
            # Update these version checks once official patches are released
            MAJOR=$(echo $PHP_VERSION | cut -d. -f1)
            MINOR=$(echo $PHP_VERSION | cut -d. -f2)
            
            if [ "$MAJOR" -lt 7 ]; then
                echo -e "  ${RED}[CRITICAL] PHP version $PHP_VERSION is end-of-life and must be upgraded immediately${NC}"
            elif [ "$MAJOR" -eq 7 ]; then
                echo -e "  ${RED}[HIGH] PHP 7.x reached end-of-life. Upgrade to PHP 8.x immediately${NC}"
            else
                echo -e "  ${YELLOW}[WARNING] Verify this version includes patches for CVE-2026-109618 and CVE-2026-109619${NC}"
                echo "  Check official PHP security advisories: https://www.php.net/security/"
            fi
        else
            echo -e "  ${RED}[ERROR] Could not determine PHP version${NC}"
        fi
    done
fi

echo ""
echo "======================================"
echo "Checking PHP-FPM status and configuration"
echo "======================================"

# Check if PHP-FPM is running
if systemctl is-active --quiet php-fpm 2>/dev/null || systemctl is-active --quiet php8.1-fpm 2>/dev/null || systemctl is-active --quiet php8.2-fpm 2>/dev/null; then
    echo -e "${YELLOW}[!] PHP-FPM is running${NC}"
    
    # Check for recent crashes/restarts
    echo "[*] Checking for recent PHP-FPM crashes (potential exploitation attempts)..."
    journalctl -u php*-fpm --since "24 hours ago" | grep -iE "segfault|crash|sigsegv|memory" || echo "  No obvious crashes found"
    echo ""
else
    echo -e "${GREEN}[+] PHP-FPM is not running${NC}"
fi

echo "======================================"
echo "Remediation Steps"
echo "======================================"

echo ""
echo "IMMEDIATE ACTIONS REQUIRED:"
echo "1. Update PHP to the latest security release:"
echo "   - Debian/Ubuntu: sudo apt update && sudo apt upgrade php*"
echo "   - RHEL/CentOS: sudo yum update php* or sudo dnf update php*"
echo "   - Windows: Download latest from https://windows.php.net/download/"
echo ""
echo "2. Restart PHP-FPM and web server services:"
echo "   sudo systemctl restart php*-fpm"
echo "   sudo systemctl restart apache2  # or nginx, httpd"
echo ""
echo "3. Verify the update:"
echo "   php -v"
echo "   php-fpm -v"
echo ""
echo "4. Review CISA KEV Catalog entry:"
echo "   https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
echo ""
echo "5. Implement network-level mitigations if patching is delayed:"
echo "   - Deploy WAF rules to filter malicious requests"
echo "   - Restrict PHP-FPM to localhost if not needed externally"
echo "   - Enable SELinux/AppArmor mandatory access controls"
echo ""

# Check for containerized PHP deployments
echo "======================================"
echo "Checking for containerized PHP deployments"
echo "======================================"

if command -v docker &> /dev/null; then
    echo -e "${YELLOW}[*] Checking Docker images for PHP...${NC}"
    docker images | grep -i php || echo "  No PHP images found"
    echo ""
    echo "ACTION REQUIRED:"
echo "  Rebuild container images with: docker build --pull --no-cache"
    echo "  Ensure base images are updated: FROM php:latest or specific patched version"
else
    echo "  Docker not installed or not in PATH"
fi

echo ""
echo "======================================"
echo -e "${GREEN}Assessment complete. Prioritize patching internet-facing systems.${NC}"
echo "======================================"

2. **PHP-FPM pool isolation**:
   - Run each application in a separate PHP-FPM pool with dedicated user accounts
   - Configure `chroot` jails for high-risk applications
   - Set resource limits (`pm.max_children`, `pm.max_requests`) to prevent resource exhaustion

3. **Regular vulnerability scanning**:
   - Integrate PHP version checks into CI/CD pipelines
   - Use tools like `composer audit` to identify vulnerable dependencies
   - Subscribe to PHP security announcements: [https://www.php.net/security/](https://www.php.net/security/)

4. **Defense in depth**:
   - Implement Content Security Policy (CSP) headers to limit XSS impact
   - Use HTTPS with HSTS to protect against MITM attacks
   - Deploy network intrusion detection systems (NIDS) tuned for web application attacks

## Conclusion

The addition of CVE-2026-109618 and CVE-2026-109619 to the CISA KEV Catalog is a clear signal: these PHP vulnerabilities are under active exploitation and pose immediate risk to any organization running PHP. Memory corruption flaws in the PHP interpreter provide attackers with a direct path to remote code execution, and stale request-state vulnerabilities can be chained for maximum impact.

This is not a vulnerability to schedule for next quarter's maintenance window. Patch now. Hunt for indicators of compromise. Implement layered defenses. The threat actors exploiting these CVEs are not waiting — neither should you.

## Related Resources

[Security Arsenal Penetration Testing Services](https://securityarsenal.com/services/penetration-testing)
[AlertMonitor Platform](https://securityarsenal.com/products/alertmonitor)
[Book a SOC Assessment](https://securityarsenal.com/contact)
[vulnerability-management Intel Hub](https://securityarsenal.com/intel/incident-response)