Back Socdefenders.Ai

CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)

Socdefenders.Ai • October 27, 2026

CVE-2026-109618 is a pointer underflow vulnerability in PHP's CGI SAPI that allows unauthenticated remote code execution.

The vulnerability affects all PHP versions from 5.x to 8.4.26 with the default configuration (cgi.fix_pathinfo=1), exposing approximately 884,000 internet-facing hosts.

Recommended mitigation includes setting cgi.fix_pathinfo=0 in the php.ini configuration file.

Technical Details: The vulnerability arises from a missing bounds check in path_info pointer arithmetic within the CGI SAPI, allowing attackers to exploit it through an out-of-bounds read and subsequent code execution via .user.ini file injection.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Remote Code Execution Vulnerabilities Disclosed Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.x to 8.4.26 have been disclosed. These vulnerabilities allow unauthenticated remote code execution, potentially compromising approximately 884,000 internet-facing hosts. CVE-2026-109618 is a pointer underflow vulnerability in PHP's CGI SAPI, while CVE-2026-109619 involves global state corruption after a fatal error. Security updates are available, and administrators are urged to apply them immediately. The vulnerabilities were first publicly disclosed on October 21, 2026, and were added to the CISA KEV list on October 26, 2026, indicating attempts. Early reports suggest attempts to exploit these vulnerabilities have already been observed. Organizations are advised to prioritize patching internet-facing PHP systems and to consider taking vulnerable systems offline if immediate updates cannot be applied. 2 sources 73

Extracted Entities

CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

Platforms (2)