90
There isn't an easy exploit for this PHP vulnerability (eliastaylor.com)
submitted 2 weeks ago by to c/selfhosted@lemmy.world
30 comments fedilink hide all child comments
 

I came across the link via https://mastodon.social/@CuratedHackerNews/117481600704689796

Last time I touched php it was ~20 years ago and maybe for a month. Could someone with actual php understanding weigh in?

Somehow, somewhere between the lines, my understanding was that there have been observances of the vuln being used in the wild before the 14 UTC. And that wasn't from reading news sites

you are viewing a single comment's thread
view the rest of the comments
[–] 14 points 2 weeks ago (5 children)

There are two CVE's (CVE-2026-109618, CVE-2026-109619), both with a rating of 9.2 out of 10. They allow unauthenticated code execution.

From the phpfoundation website:

CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP's memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale global state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] [S] 0 points 2 weeks ago (4 children)

    Yes, but from the page I linked

    One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

    It's not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

    For sure that this is still a bug that should be patched. But I do remember "don't eval on user sent stuff" rule. Or is this really prevalent in PHP ecosystem?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 weeks ago (2 children)

    Dont use eval, period

    If you use eval, you're doing it wrong

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 2 points 2 weeks ago (1 child)

    That is my understanding too. But then when I was reading the article, there was a line somewhere that in order for the exploit to be successful, the server needs to be using eval

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 day ago

    Literally the first thing indo after installing PHP is disabling the eval and assert functions.asssert() might might be useful in unit tests but thats about it, but eval is just plain evil and should never be used and if you do you are doing whatever you are doing, wrong.

  • permalink
  • fedilink
  • source
  • parent