PHPにリモートコード実行の弱点、修正版が公開
Summary
PHP 8.2から8.5の各系統に、メモリ不足の処理の不備から外部の第三者がサーバー上で任意のコードを実行できる可能性のある弱点が見つかり、修正版が公開されました。PHPでWebアプリケーションを動かしている組織が対象で、深刻度はCVSS v4で9.2(critical)です。まず自社のPHPの版を洗い出し、8.2.35、8.3.36、8.4.27、8.5.12以降へ更新してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
PHP 8.2から8.5の各系統に、メモリ不足の処理の不備から外部の第三者がサーバー上で任意のコードを実行できる可能性のある弱点が見つかり、修正版が公開されました。PHPでWebアプリケーションを動かしている組織が対象で、深刻度はCVSS v4で9.2(critical)です。まず自社のPHPの版を洗い出し、8.2.35、8.3.36、8.4.27、8.5.12以降へ更新してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| PHP GroupPHP |
≥ 8.2.0, < 8.2.35→ 8.2.35 ≥ 8.3.0, < 8.3.36→ 8.3.36 ≥ 8.4.0, < 8.4.27→ 8.4.27 ≥ 8.5.0, < 8.5.12→ 8.5.12 |
8.2.35 8.3.36 8.4.27 8.5.12 |
| Bitnamiphp-min |
≥ 7.3.0, < 8.2.35→ 8.2.35 ≥ 8.3.0, < 8.3.36→ 8.3.36 ≥ 8.4.0, < 8.4.27→ 8.4.27 ≥ 8.5.0, < 8.5.12→ 8.5.12 |
8.2.35 8.3.36 8.4.27 8.5.12 |
| Bitnamilibphp |
≥ 7.3.0, < 8.2.35→ 8.2.35 ≥ 8.3.0, < 8.3.36→ 8.3.36 ≥ 8.4.0, < 8.4.27→ 8.4.27 ≥ 8.5.0, < 8.5.12→ 8.5.12 |
8.2.35 8.3.36 8.4.27 8.5.12 |
| Bitnamiphp |
≥ 7.3.0, < 8.2.35→ 8.2.35 ≥ 8.3.0, < 8.3.36→ 8.3.36 ≥ 8.4.0, < 8.4.27→ 8.4.27 ≥ 8.5.0, < 8.5.12→ 8.5.12 |
8.2.35 8.3.36 8.4.27 8.5.12 |
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Alpine Linux ALPINE-CVE-2026-109618 php85, php84, php83 +1 more Fix available
- BellSoft Alpaquita BELL-CVE-2026-109618 php83, php81 Fix available
- Debian DEBIAN-CVE-2026-109618 php8.4, php8.2 Fix available
- Ubuntu UBUNTU-CVE-2026-109618 php8.5, php8.3, php8.1 +4 more Fix available
Original description The description as published by the source.
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Source: NIST National Vulnerability Database NVD GitHub Advisory CISA KEV
References
- advisory github.com
- advisory wiz.io
- advisory nvd.nist.gov
- advisory arcticwolf.com
- advisory php2shell.delftintellab.com
- advisory github.com
- AWS aws.amazon.com
- CISCO sec.cloudapps.cisco.com
- CISCO sec.cloudapps.cisco.com
- DSA DSA-6574-1
- ICSA cisa.gov
- ICSA cisa.gov
- JVN JVNVU99905564
- JVN JVNDB-2026-039073
- POC EDB-52704
- REDHAT Red Hat
- web openwall.com
- web cert-portal.siemens.com
- web openwall.com
- web cisa.gov
- web seclists.org
- web cert-portal.siemens.com
- web cert-portal.siemens.com