> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CISA KEV adds PHP RCE CVE-2026-109619, mandating urgent patching for financial services - URL: https://f4n6.co.uk/security-feed/cisa-kev-adds-php-rce-cve-2026-109619-mandating-urgent-patching-for-financial-services/ - Published: 2026-10-27T11:40:12.000Z - Updated: 2026-10-27T11:40:12.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-109619 ## 1\. Executive summary CVE-2026-109619 is a use-after-free in the PHP runtime (CVSS 9.2, critical) that allows unauthenticated remote code execution against any PHP installation serving web requests. CISA added it to the Known Exploited Vulnerabilities catalogue with a remediation due date of 2026-10-29, and EPSS records a 100% probability of exploitation in the next 30 days. The flaw is reachable before application code runs, so patching the CMS, framework or application does not remove it; only a patched PHP build does. EMEA financial services firms running PHP-FPM, Apache mod\_php, php-cgi, FrankenPHP or LiteSpeed on internet-facing estates should treat this as an emergency change outside the normal patch cycle. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17 | CISA KEV lists CVE-2026-109619 as exploited with a 2026-10-29 remediation deadline, and CERT-FR reports exploitation attempts against specific PHP deployments | The ICT-related incident management process must cover emergency patching of an actively exploited runtime flaw, with a defined owner, timeline and evidence trail for the 72-hour window | | DORA Art. 19 | Active exploitation of an internet-facing runtime that underpins customer-facing web applications | If exploitation succeeds on a production system, the firm must assess whether it is a major ICT-related incident and report to its competent authority within the classification and reporting process | | NIS2 Art. 21(2)(d) | PHP is a third-party runtime component embedded across the supply chain, including managed hosting and vendor-supplied applications | Supply chain security measures must extend to confirming that hosting providers and software vendors have deployed a patched PHP build, not just the firm's own servers | ## 3\. Technical analysis & attack chain CVE-2026-109619 is a cross-request use-after-free in PHP's internal request-state handling. A worker process retains a reference to request-owned state after the backing memory has been freed at the end of an earlier request. A later request handled by the same worker can read that stale value before normal initialization clears it. NVD classifies it CWE-416 (Use After Free) with CWE-755 alongside; Rapid7 and Snyk describe the same mechanism as stale global state surviving between requests. The CVSS 9.2 critical rating is consistent across NVD and the vendor-adjacent reporting. Confirmed attack sequence, drawn from the PHP advisories as relayed by Rapid7, Snyk and Sucuri: 1. The attacker sends requests to a PHP endpoint that cause internal state to be left behind after a request completes. Session upload progress (session.upload\_progress), enabled by default, is a documented early consumer of stale session or decoder state and does not require the application to call session\_start(). 2. A fatal error (memory exhaustion, execution timeout, or a shutdown diagnostic) interrupts state cleanup, or a nonfatal diagnostic during shutdown repopulates error state after it was reset. 3. A subsequent request reaches the same worker and consumes the stale state before initialization resets it, giving the attacker control over a value the runtime treats as valid. 4. Code execution follows with the privileges of the web worker. The advisory confirms RCE against Apache mod\_php through PHP 8.5's fatal error backtrace feature when fatal\_error\_backtraces is enabled (the default), and confirms a session lifecycle RCE path against both mod\_php and PHP-FPM. The FPM path is narrower than the mod\_php path. It requires an application operation that leaves state behind after successful startup, then a fatal error, then another request that consumes the stale state through session upload progress, and both requests must land on the same worker. Multiple workers and worker recycling reduce success per request but do not eliminate the condition. Rapid7 reports no complete FPM exploit for this CVE at the time of writing, though source analysis supports FPM susceptibility after successful startup. Exploit portability and reliability depend on the PHP build, loaded extensions, frontend behaviour and memory layout. Affected deployments are all PHP installations serving web requests: PHP-FPM, Apache mod\_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod\_php the highest risk because exploitation can succeed before any application code runs. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35\. PHP 8.1 and older are out of upstream support; the project published emergency source backports for 7.4, 8.0 and 8.1, and Linux distributions and LTS vendors may ship patched packages. PHP 8.2 reaches end of life on 2026-12-31. Exploitation status. CISA KEV records CVE-2026-109619 as exploited. CERT-FR states it has observed exploitation attempts against specific PHP deployments. Sucuri reports public proof-of-concept code circulating before the fixes and quotes Hadrian saying "We are now seeing php2shell exploited in the wild at scale", with most observed activity abusing the session upload-progress path; WatchTowr, Patchstack, Cloudflare and Vega also reported malicious activity or attempts. Rapid7 expected a viable public exploit soon after 2026-10-21\. The "at scale" characterisation and the specific exploitation volume rest on vendor reporting and are single-sourced per claim; treat them as indicative rather than measured. Attempts are not the same as successful compromise. The companion flaw CVE-2026-109618 (RCE via out-of-memory corruption) is a separate CVE and is not the subject of this advisory's KEV entry, but it ships in the same fixed releases and the same emergency change should close both. ## 4\. Mitigation & containment P1, within 24 hours: - Update every PHP build serving web requests to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, using the OS package manager, hosting control panel or established deployment pipeline. Restart or reload PHP workers and the web server so the patched build is live. - Verify the version actually serving traffic, not just the CLI. Run php -v and separately confirm the web server's PHP version (for example a phpinfo() page or the FPM pool status), because the CLI and web builds can differ. - Where patching cannot complete inside 24 hours, apply the interim configuration from CERT-FR and Kaspersky: set session.upload\_progress.enabled = Off in php.ini, and for PHP-FPM pools set php\_admin\_flag\[session.upload\_progress.enabled\] = off. This reduces attack surface for CVE-2026-109619 only; it does not mitigate CVE-2026-109618. - At the WAF, block or alert on HTTP requests whose Content-Type is multipart, per CERT-FR. If blocking breaks legitimate uploads, run it in monitoring mode and alert on volume anomalies. P2, within 72 hours: - Inventory every PHP runtime in the estate, including vendor-supplied appliances, SaaS-adjacent applications and container base images, and confirm each is on a fixed build. Container images must be rebuilt, not patched in place. - For PHP 8.1 and older, obtain a distribution or LTS-vendor backport, or upgrade to a supported branch. Do not leave an unpatched 8.1, 8.0 or 7.4 install exposed. - On shared or managed hosting, obtain written confirmation from the provider that a patched PHP build is deployed, and check the control panel's PHP version selector. - Hunt for post-exploitation signs on any host that was internet-facing and unpatched: unfamiliar PHP files in web roots, unexpected scheduled tasks or cron entries, unknown administrative accounts, and suspicious outbound connections from the web server process. P3, within 7 days: - Plan the move off PHP 8.2 before its 2026-12-31 end of life. - Review whether fatal\_error\_backtraces can be disabled in your environment as defence in depth, noting that the mod\_php RCE path depends on it being enabled by default. - Add the PHP runtime to the third-party risk register under DORA Art. 28/30 so future runtime CVEs have a named owner and contractual patch SLA. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. The sources describe behaviours and detection verdict names only. Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------ | ----------------------------------------------- | -------------------------------------------- | | Multipart/form-data requests crafted to exhaust worker memory or trigger fatal errors | Web server and WAF logs, PHP-FPM slow log | Medium, single-sourced to CERT-FR and Rapid7 | | Repeated requests landing on the same worker followed by a fatal error and a session upload-progress request | PHP-FPM access and error logs, application logs | Medium, from the documented FPM path | | Unfamiliar PHP files appearing in web roots | File integrity monitoring on web directories | Medium, Sucuri guidance | | Unexpected scheduled tasks, cron entries or unknown administrative accounts | Host EDR, OS audit logs | Medium, Sucuri guidance | | Suspicious outbound connections from the web server process | Network flow logs, EDR | Medium, Sucuri guidance | Vendor detection verdicts (Kaspersky, single source): Exploit.CVE-2026-109618.HTTP.C&C, Exploit.CVE-2026-109619.HTTP.C&C, PDM:Exploit.Linux.Generic, PDM:Exploit.Win32.Generic. ## 6\. Detection The sources give no file artefacts, strings or command lines specific to the exploit, so a YARA rule built on threat artefacts cannot be written without fabricating content. Detection should rest on the behavioural signals above: WAF rules on multipart Content-Type volume, PHP-FPM error-log alerting on fatal errors clustered on one worker, and file-integrity alerting on new PHP files in web roots. Sigma rules for these behaviours would require log field names not supplied in the sources; author them against your own web server and FPM log schema rather than a generic template. Insufficient indicators to author detection rules. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ---------------------------------------------------------------------------------- | ------------ | --------- | ---- | ------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619?ref=f4n6.co.uk) | 9.2 Critical | — | 100% | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly… | ## 7\. Sources - NVD, CVE-2026-109619, https://nvd.nist.gov/vuln/detail/CVE-2026-109619, 2026-10-26 - CISA Known Exploited Vulnerabilities, CVE-2026-109618, https://nvd.nist.gov/vuln/detail/CVE-2026-109618 - Rapid7 Blog, CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP, https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php - Snyk, PHP Patches Two Critical Unauthenticated RCEs (CVE-2026-109618, CVE-2026-109619): Update Now, https://snyk.io/blog/php-patches-critical-unauthenticated-rces/, 2026-10-22 - Sucuri Blog, Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619), https://blog.sucuri.net/2026/10/critical-php-security-update-two-rce-flaws-cve-2026-109618-cve-2026-109619.html - Securelist (Kaspersky GReAT), Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619), https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/ - ANSSI CERT-FR, \[Màj\] Multiples vulnérabilités dans PHP, https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014/, 2026-10-26 ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-109619 as critical (CVSS 9.2) and actively exploited per CISA KEV, with a 2026-10-29 remediation deadline and EPSS at 100%. The client impact is high for any EMEA financial services firm with internet-facing PHP, because the flaw is reachable before application code and patching the application layer does not fix it. The "exploited at scale" claim and the specific exploitation volume rest on vendor reporting and are single-sourced; we treat them as indicative and will verify before citing them to regulators. We will track the PHP fixed releases and distribution backports, monitor for public exploit tooling and new attack paths beyond the session upload-progress route, and reissue this advisory if a working FPM exploit or confirmed in-the-wild compromise against a financial services target is reported. Clients should confirm their patched-build status to us so we can prioritise follow-up. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-109619?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*