Special edition: CVE-2926-109618 (Update #2)

Kia ora, this is a special edition of It's Probably Nothing. PHP's two leaked core vulnerabilities have moved from embargo drama to a patching job. Fixes are available, and FPM isn't a blanket exemption. This assessment is current to 9:40am New Zealand daylight time on 22 October.

Since our last assessment, PHP has published fixes, technical advisories and both vulnerability records. watchTowr now reports active exploitation attempts against both flaws. That's an attributed observation, not independently verified successful compromises or a measured global campaign. Some legacy installations now have backport options too.

The timeline starts before the leak. Wiz says it reported the vulnerabilities on 24 August. Their existence leaked on Hacker News on 20 October, and PHP subsequently scheduled fixes for 14:00 UTC on 21 October. That was the announced schedule, not an established actual release minute.

Both flaws have official CVSS version four scores of 9.2. The first leaves partially initialised memory reachable after an out-of-memory abort. The second leaves freed request state available for a later request in the same worker to consume. These are PHP core bugs, not application-framework bugs.

PHP puts all installations serving web requests in the at-risk population. mod_php has the highest demonstrated risk, including exploitation before application code runs. For the first flaw, PHP confirms complete remote code execution over HTTP against mod_php, but says a complete FPM exploit hasn't been demonstrated.

The second flaw has confirmed remote code execution paths against both mod_php and FPM. The validated FPM path requires a suitable application operation after request startup, so configuration and application behaviour matter. “Every PHP site falls instantly” overstates the evidence; “we use FPM” doesn't settle it either. Successful exploitation runs code with the web worker's privileges, not automatically as root. PHP also confirms memory disclosure for the second flaw.

The upstream fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distribution backports can look older: Ubuntu 24.04 has a package fixing both vulnerabilities while retaining an older upstream version number. Check the full package build, not just the upstream-looking version.

PHP has also supplied minimal source backports for 7.4, 8.0 and 8.1, without restoring normal support. AlmaLinux's update at 17:50 UTC on 21 October puts its 7.4 fix in production, with its other shipped streams still in testing.

If you're on Laravel Forge, automatic security updates don't cover PHP. Update each installed version, verify that the repository offers a fixed build, and restart long-running PHP processes.

PHP says updating is the only complete solution. Configuration switches can block particular paths, but not the whole problem.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.