| |
KC2NJV > NEWS 22.10.26 16:30l 20 Lines 1571 Bytes #999 (0) @ WW
BID : 16308_KC2NJV
Subj: Critical security issue affecting PHP
Path: DB0FFL<OE2XZR<OK1TOR<SR6DWH<SR5DDD<SR4BBX<SR1BSZ<EA2RCF<LU9DCE<KC2NJV
Sent: 261022/1336Z 16308@KC2NJV.#NASS.NY.USA.NOAM LinBPQ6.0.26
From: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
What has happened?
PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. PHP is also used in a range of other products.
The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.
CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
The full PHP security advisory provides more details regarding the fixed security issue.
The NCSC will continue to monitor for any impact on UK organisations.
73 de KC2NJV
Lese vorherige Mail | Lese naechste Mail
| |
