Two CVEs, Five Runtime Handlers: Reading the 9.2 Score
Both CVE-2026-109618 and CVE-2026-109619 end in remote code execution, and both leak stale state between requests handled by the same worker process.
CVE-2026-109618 sits in the memory-exhaustion path: when PHP handles an OOM exception, some internal request data may never be initialized correctly and then gets misused during cleanup. CVE-2026-109619 is the sibling — internal state outlives the memory block it pointed at, and the next request on that worker can pick up the dead pointers.
PHP rates both 9.2 under CVSS 4.0 and singles out Apache mod_php as the worst case. That detail matters: an unauthenticated request can trigger the flaw before application code runs, so login middleware, CSRF tokens and route guards buy you nothing.
| Handler | Where the exposure shows up | Practical note |
|---|---|---|
| PHP-FPM | long-lived workers reuse the process | patch, then recycle the pool master |
| Apache mod_php | fires pre-script | highest risk per the advisory |
| php-cgi | per-request process | still exposed, still needs the patch |
| FrankenPHP | bundled SAPI build | check the vendor build date, not the PHP version string |
| LiteSpeed (lsapi) | persistent worker | rebuild against the patched branch |
Takeaway: open your vhost configs and write down the handler next to each one. Every vhost on mod_php is a migration candidate first and a patch candidate second.
Deployment Environment: Three Version Calls to Make Before the First Request
Pin supported branches and verify them inside the running container, because control panels routinely report the wrong binary.
| Component | Target | Why it matters |
|---|---|---|
| PHP-FPM | 8.3.x / 8.4.x, patched build | 8.1 and 8.2 are security-only; older branches get no fix at all |
| Node.js | 20.x or 22.x LTS | 18.x reached end-of-life in April 2025 |
| Composer / npm | audit before first boot | vendored libraries hide the real dependency version |
When I moved a small mod_php vhost to FPM, the only breakage was a hard-coded superglobal in a stats page — about fifteen minutes of work, and the riskiest SAPI left the stack. Run php -v and node -v inside the container; the host answer is frequently wrong.
Suitable project types for this kind of review pass:
Original Reference
Original title: PHP 与 Node.js 紧急安全问题漏洞_热点资讯
Original excerpt:
PHP 开发团队宣布将发布补丁修复两处严重安全漏洞。欧盟网络安全官员警告，无法安装补丁的机构应将受影响的网站下线。
PHP 被互联网上大量网站采用。过去一天，有关使用 PHP 的网站可能遭到严重网络入侵的猜测不断流传。
网络安全公司 Huntress 在博客中写道：“PHP 无处不在。从 WordPress、Drupal、Joomla 和 Magento 网站，到共享主机平台、管理面板，再到许多根本没有注明底层使用 PHP 的软件，背后都有 PHP 在默默提供支持。”
PHP 开发团队在安全通报中称，按照通用漏洞评分系统（CVSS）4.0 版的标准，两处漏洞的严重程度均达到 9.2 分，并敦促用户在修复版本发布后尽快升级。
当地时间 20 日，欧盟计算机应急响应小组（CERT-EU）发布安全公告称，9.2 分的评分表明，两处漏洞存在未经身份验证即可远程执行代码的风险。攻击者可能利用此类漏洞，在无需登录的情况下远程运行恶意代码。
CERT-EU 敦促各机构做好补丁发布后立即修复受影响系统的准备，无法及时修复的机构则应考虑让受影响的网站暂时下线。
澳大利亚网络安全中心（ACSC）也提出了类似建议，敦促各机构排查使用 PHP 的系统，准备安装补丁，并监测应用程序是否存在恶意活动迹象。IT之家获悉，该中心目前尚未发现有人实际利用这些漏洞发动攻击。
网站托管服务商 GoDaddy 警告，攻击
Original screenshots:
Disclaimer
⚠️ This article is for educational research and technical exchange only. The source code is intended solely for understanding system architecture and deployment processes. Do not use it for illegal purposes. Any commercial operation is unrelated to the author.
