Latest / The Digital Warfare Podcast / EP. 190: CVE-2026-109618: Critical PHP Memory Corruption Enables Remote Code Execution
Transcript
- riverside 6ae07bece6aad3f38f53d242 0 final padding digital warfare's s: This is no longer a patch and watch situation. Attackers are successfully exploiting PHP 2 shell in the wild, and vulnerable servers are now real targets. Welcome to the Digital Warfare Daily Brief. Today we are tracking CVE-2026-109618, a critical PHP memory corruption vulnerability that can lead to unauthenticated remote code execution. The floor carries a CVSS score of 9.2. And here is the consequence that matters. An attacker may be able to send crafted requests to a vulnerable PHP server and gain code execution before the application itself ever gets a chance to protect you. That means the weakness can sit below your framework, below your CMS, below your business logic, inside the PHP runtime itself. CVE-2026-109618 is triggered through PHP's out-of-memory handling. Under specific conditions, PHP can be interrupted while internal request data is only partially initialized. The cleanup process then continues and treats invalid internal state as if it were legitimate. That creates a memory corruption condition. And with enough control over memory layout, that corruption can be turned into remote code execution. This is not theoretical anymore. Successful exploitation has now been observed in the wild, and that changes the response completely. Internet-facing PHP servers should be treated as high-priority assets until defenders can prove they are patched and clean. The risk is broad. Affected environments include PHP FPM, Apache with mod underscore PHP, PHP CGI, FrankenPHP. And Lightspeed. The PHP project says the risk is especially serious for mod underscore PHP, where unauthenticated exploitation has been demonstrated before application code runs. Now think about what PHP actually powers: public websites, APIs, content management systems, administrative portals, embedded management interfaces, cloud workloads, and industrial platforms. That last point matters. Industrial vendors, including Siemens, Schneider Electric, ABB, Rockwell Automation, and Johnson Controls, have been assessing products for exposure to PHP 2 Shell, with several confirming affected products. So this is not just a web hosting issue anymore. The vulnerable runtime may be buried inside systems organizations do not immediately associate with PHP at all. That is where defenders get caught. They patch the obvious web servers. And miss the management appliance. The gateway. The storage platform. The industrial interface. Or the embedded control plane quietly running PHP underneath. Now the defensive orders. Inventory PHP everywhere. Not just where developers tell you PHP is running. Check containers, check appliances, check edge infrastructure, check management systems, check vendor platforms. Then patch. Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you are still running PHP 8.1 or older, understand the position clearly. The upstream PHP project is not patching those versions. Upgrade or isolate them. And do not stop after installing the package update. Restart the actual PHP workers. If PHP FPM, Apache, FrankenPHP, or Lightspeed is still running the old binary in memory, the vulnerability can remain active even though the package on disk has been replaced. Then hunt. Look for suspicious child processes spawned by PHP workers. Watch for shell execution. Curl, Wget, Python, Netcat, unexpected outbound traffic, abnormal PHP session cookies, worker crashes. Core dumps, and repeated requests designed to manipulate worker memory. If you find signs of exploitation, treat the server as compromised. Do not simply patch and move on. Capture volatile evidence first where possible. Rotate exposed credentials. Check persistence. Inspect downstream systems, and establish what the compromised PHP process could reach. Because once remote code execution is achieved, the vulnerability is no longer the biggest problem. The attacker is. CVE-2026-109618 is now a live operational threat. The patch exists, the exploit path works, and exposed systems are being tested. Find the runtimes, patch them, restart them, then hunt for whoever may have arrived first. This has been the Digital Warfare Daily Brief. Stay secure and stay ahead.