Fedora PHP Update Patches Two Critical Code Execution Flaws (CVE-2026-109618, CVE-2026-109619) — Patch and Detection Guide

Fedora has released an urgent PHP security update (Fedora 44 advisory php-2026-a9eba4bbc3) addressing two critical code execution vulnerabilities: CVE-2026-109618, a memory corruption flaw triggered through out-of-memory (OOM) conditions, and CVE-2026-109619, a code execution flaw caused by stale global state reuse. Any organization running PHP workloads on Fedora — particularly internet-facing web applications — should treat this as a patch-now event.

PHP remains one of the most broadly deployed server-side runtimes on the internet, which makes memory-safety and state-corruption bugs in the interpreter a high-value target. Flaws in this class are routinely weaponized for initial access against web servers, and both of these CVEs sit squarely in the category attackers look for when building reliable exploitation primitives.

What Happened

The Fedora Security Team published an update for the PHP packages shipping in Fedora 44 that resolves two distinct critical vulnerabilities:

• CVE-2026-109618 — A critical code execution vulnerability involving memory corruption during OOM handling. When the PHP engine hits memory-allocation failure conditions, the corrupted state can be steered into arbitrary code execution rather than a clean failure.
• CVE-2026-109619 — A critical code execution vulnerability rooted in stale global state. The engine fails to properly reset internal global state between execution contexts, allowing a crafted request to inherit poisoned state from a prior execution and achieve code execution.

Both flaws are in the PHP interpreter itself, meaning any SAPI that exposes PHP to untrusted input — mod_php, PHP-FPM, or even CLI-driven queue workers processing attacker-controlled data — is potentially in scope.

Technical Analysis

Affected Products and Platforms

• Product: PHP interpreter packages as shipped by Fedora
• Platform: Fedora 44 (advisory fedora-44-php-2026-a9eba4bbc3)
• Exposure surface: Any service executing PHP against untrusted input — Apache with mod_php, Nginx/Apache fronting PHP-FPM, containerized PHP images built on Fedora base layers, and CI/CD or cron-driven PHP jobs handling external data

Organizations running RHEL-family rebuilds or containers layered on Fedora images should verify whether their PHP packages track the Fedora build. Do not assume your distro is unaffected simply because the advisory is Fedora-labeled — check your package provenance.

How the Vulnerabilities Work (Defender's Perspective)

CVE-2026-109618 — OOM-driven memory corruption. Bugs in OOM handling paths are dangerous because allocation-failure code paths are historically undertested. When the Zend engine (or an extension) fails an allocation mid-operation, internal structures can be left partially initialized or freed inconsistently. An attacker who can reliably influence memory pressure — for example, by sending requests that force large allocations — can push the engine into this corrupt path and, in the worst case, convert the corruption into controlled execution. From a defensive standpoint, this means resource-exhaustion is not just an availability concern; on unpatched builds it is a code execution vector.

CVE-2026-109619 — stale global state. PHP's per-request lifecycle assumes global state is fully torn down and reinitialized. When that teardown is incomplete, state from a previous request — user context, internal pointers, engine flags — leaks into the next request handled by the same worker. In persistent-process models like PHP-FPM (where workers handle many sequential requests), this is exactly the condition an attacker wants: send a first request to poison state, then a second to trigger execution against the poisoned context. FPM worker pools and long-lived processes amplify the blast radius of state-leak bugs.

Exploitation Requirements and Status

• Exploitation of CVE-2026-109618 requires the ability to drive the interpreter into an OOM condition — plausible for unauthenticated remote attackers against memory-intensive endpoints (file uploads, unserialization, large JSON/XML parsing).
• Exploitation of CVE-2026-109619 requires repeated interaction with the same PHP worker, which load-balanced FPM deployments still permit frequently enough to matter.
• At the time of this writing, there is no confirmed public exploit or CISA KEV listing for either CVE. Treat both as exploitable-in-principle: memory corruption and state-reuse bugs in PHP have a long history of rapid weaponization once details circulate. The window between advisory publication and working exploit is measured in days for this class of bug.

Detection & Response

Memory-safety bugs inside the interpreter rarely leave clean pre-exploitation telemetry. The highest-fidelity detections focus on post-exploitation behavior: a PHP worker doing things a PHP worker should never do. A PHP-FPM or httpd child spawning a shell, downloading payloads, or making unexpected outbound connections is a near-certain indicator of successful code execution — regardless of which CVE got the attacker in.

Sigma Rules

---
title: PHP-FPM or Apache Spawning Shell or Downloader
description: Detects php-fpm or Apache worker processes spawning interactive shells or download utilities, a strong indicator of post-exploitation following PHP interpreter code execution such as CVE-2026-109618 or CVE-2026-109619.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-php-2026-a9eba4bbc3
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 3f9c2a71-8b4d-4e6a-b1c2-9d7e5f0a1234
status: experimental
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/httpd'
      - '/apache2'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate admin tooling invoked from PHP exec() calls; tune per application
level: high
---
title: PHP Interpreter Crashes Under Memory Pressure
description: Detects repeated PHP or PHP-FPM process crashes (segfaults/aborts) which may indicate active attempts to trigger the OOM memory corruption condition described in CVE-2026-109618.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-44-php-2026-a9eba4bbc3
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/04/06
id: 8c1e4d92-2f7a-4b3c-a5e6-1c8d9b0f2345
status: experimental
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/php'
      - '/php-fpm'
    CommandLine|contains:
      - 'segmentation fault'
      - 'core dumped'
  condition: selection
falsepositives:
  - Legitimate extension bugs; investigate rather than ignore repeated crashes on web-facing hosts
level: medium

KQL (Microsoft Sentinel / Defender)

If your Fedora web servers ship Syslog or auditd data into Sentinel (via the Syslog/CEF connectors), hunt for web-tier processes spawning unexpected children and for crash patterns consistent with exploitation attempts:

// Hunt: PHP-FPM / Apache spawning suspicious child processes (post-exploitation behavior)
// Relevant to CVE-2026-109618 and CVE-2026-109619
let suspiciousChildren = dynamic(["/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget", "/usr/bin/nc", "/usr/bin/python3", "/usr/bin/perl"]);
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("php-fpm", "httpd", "apache2", "php")
| extend Msg = tostring(SyslogMessage)
| where Msg has_any ("execve", "/bin/sh", "/bin/bash", "curl", "wget", "nc ")
| project TimeGenerated, Computer, ProcessName, Msg, SeverityLevel
| order by TimeGenerated desc;

// Secondary hunt: repeated PHP-FPM worker crashes / restarts indicating memory-corruption probing
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("php-fpm", "php")
| where SyslogMessage has_any ("segfault", "SIGSEGV", "core dumped", "exited on signal", "OOM", "out of memory")
| summarize CrashCount = count() by Computer, bin(TimeGenerated, 1h)
| where CrashCount > 5
| order by CrashCount desc;

The second query thresholds on crash volume because a single FPM worker restart is routine noise; sustained crash loops on a web-facing host are not.

Velociraptor VQL

For endpoint forensics on a suspected-compromised Fedora host, enumerate PHP worker processes and their network connections — a PHP worker holding an unexpected outbound connection is a classic webshell/reverse-shell artifact:

-- Identify PHP/Apache processes with active outbound network connections
-- (indicative of reverse shells or C2 following PHP code execution)
LET procs = SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'php|httpd|apache'

SELECT Pid, Name, CommandLine, Username,
       netstat().Pid AS ConnPid,
       netstat().Status AS ConnStatus,
       netstat().Raddr AS RemoteAddr,
       netstat().Rport AS RemotePort
FROM procs
WHERE RemotePort > 0
  AND NOT RemoteAddr =~ '^(127\\.|::1|10\\.|192\\.168\\.)'

Also check installed package version to confirm patch state across a fleet:

-- Verify installed PHP package version on RPM-based hosts
SELECT * FROM execve(argv=['rpm', '-q', 'php', '--queryformat', '%{NAME}-%{VERSION}-%{RELEASE}\n'])

Remediation Script

The following Bash script checks the installed PHP version against pending updates, applies the Fedora 44 security update, restarts affected services, and verifies the result. Run it on each affected host (or push it via your configuration management tooling):

#!/usr/bin/env bash
# Remediation for CVE-2026-109618 / CVE-2026-109619 (Fedora 44 PHP update)
set -euo pipefail

echo "=== Current PHP package state ==="
rpm -q php php-cli php-fpm 2>/dev/null || rpm -q php
php -v 2>/dev/null || true

echo "=== Checking for available PHP security updates ==="
dnf check-update php\* 2>/dev/null || echo "check-update returned updates or none pending (exit $?)"

echo "=== Applying PHP security update ==="
dnf upgrade -y --refresh 'php*'

echo "=== Restarting PHP-FPM and web server ==="
systemctl is-active --quiet php-fpm && systemctl restart php-fpm && echo "php-fpm restarted"
systemctl is-active --quiet httpd && systemctl restart httpd && echo "httpd restarted"
systemctl is-active --quiet nginx && systemctl reload nginx && echo "nginx reloaded"

echo "=== Post-patch verification ==="
rpm -q php php-cli php-fpm 2>/dev/null || rpm -q php
php -v

echo "=== Checking for lingering pre-patch PHP worker processes ==="
# Stale long-lived FPM masters may still run old code if not restarted; confirm process start times post-date the patch
ps -eo pid,lstart,cmd | grep -E 'php-fpm|httpd' | grep -v grep || echo "No PHP/httpd processes found"

echo "Done. Confirm package changelog references the security advisory:"
rpm -q --changelog php | head -n 20

Note the final step: restarting the service is mandatory. PHP-FPM master processes persist across package upgrades — if you patch the RPM but never restart FPM, your workers are still running the vulnerable interpreter in memory.

Remediation

1. Patch immediately. Apply the Fedora 44 PHP update from the official advisory: https://linuxsecurity.com/advisories/fedora/fedora-44-php-2026-a9eba4bbc3. Use dnf upgrade --refresh 'php*' and confirm the changelog references the security fix.
2. Restart all PHP services. Restart php-fpm, httpd/apache2, and any containerized PHP workloads. Patching without restarting leaves the vulnerable interpreter resident in memory. For containers, rebuild and redeploy images — do not patch running containers in place.
3. Inventory your exposure. Enumerate every host and container running Fedora-derived PHP packages, including forgotten queue workers, cron hosts, and internal tooling. Internet-facing FPM deployments are priority one, but CLI workers processing untrusted input are also in scope for CVE-2026-109619.
4. Reduce the attack surface while patching. Enforce strict memory_limit and max_execution_time values in php.ini, cap FPM request_terminate_timeout, and rate-limit memory-intensive endpoints (uploads, unserialization, large body parsing) at the WAF/reverse proxy. Tight memory ceilings do not fix the bug, but they shrink the window an attacker has to steer an OOM condition.
5. Constrain FPM worker blast radius. Set pm.max_requests to a low value (e.g., 100–500) so workers recycle frequently — this directly mitigates stale-state attacks like CVE-2026-109619 by limiting how many requests a single poisoned worker can serve before respawning.
6. Hunt before and after patching. Run the KQL and VQL queries above against the last 7–14 days of telemetry. Patch-then-hunt is the correct order for critical interpreter bugs: assume the vulnerability window was visible to attackers and look for post-exploitation artifacts.
7. Monitor for follow-on advisories. PHP security releases often cascade — watch the Fedora announce list and PHP.net security pages for related fixes, and track whether either CVE is added to CISA KEV, which would trigger mandated remediation timelines for federal-aligned organizations.

Bottom Line

Two critical code execution flaws in the PHP interpreter — one memory-corruption via OOM, one stale-state reuse — is about as serious as a language-runtime patch gets. The exploitation prerequisites are low (repeated unauthenticated requests), the deployment footprint is enormous, and the post-exploitation outcomes are full server compromise. Patch, restart your workers, hunt for child processes that should not exist, and tighten your FPM worker lifecycle. This is a same-day change, not a next-maintenance-window change.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub