CVE-2026-109619: 
PHP 취약점 분석 및 완화

CVE-2026-109619 is a critical use-after-free vulnerability in PHP's global state management, part of the broader "PHP2Shell" (php2shell) vulnerability cluster disclosed on October 21, 2026. PHP maintains various global state that temporarily points into request memory; in certain scenarios this state is not correctly reset or is repopulated after being reset, causing a subsequent request handled by the same worker to access freed memory before normal initialization occurs. This can result in unauthenticated remote code execution (RCE). Affected versions include PHP 8.2.x before 8.2.35, 8.3.x before 8.3.36, 8.4.x before 8.4.27, and 8.5.x before 8.5.12, as well as PHP 5.4.x and later branches below those thresholds. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 9.2 (Critical) (PHP Advisory, Red Hat).

The root cause is a use-after-free (CWE-416) combined with improper handling of exceptional conditions (CWE-755) and access of uninitialized pointers (CWE-824). PHP worker processes retain global state—including session, error, object, and extension state—that points into per-request heap memory. When a fatal error (e.g., OOM, uncaught exception, parse failure) or a non-fatal diagnostic interrupts request processing before the matching reset occurs, the global state continues to reference freed request memory. A subsequent request on the same worker can then read, branch on, or free this stale state before normal initialization replaces it. Two confirmed consumer paths exist: (1) INI diagnostics raised before php_request_startup() (e.g., deprecated settings in .htaccess or PHP_VALUE headers) that access stale error state, and (2) the session upload-progress handler, which runs before ordinary session initialization and can consume stale session or decoder state. Unauthenticated RCE has been demonstrated against Apache mod_php and PHP-FPM. The attack requires no authentication and no user interaction, but does require that a producer and consumer request reach the same worker process (PHP Advisory, oss-security).

Successful exploitation allows an unauthenticated remote attacker to achieve heap use-after-free, memory disclosure, and full remote code execution with the privileges of the web server worker process. All three CIA pillars are fully compromised: confidentiality (access to sensitive data including password hashes and MFA secrets), integrity (arbitrary code execution and file modification), and availability (worker crash or takeover). Unit 42 reported that in at least one confirmed intrusion against a European government entity, attackers reached password hashes and MFA secrets within two hours of exploitation. The vulnerability affects any PHP-based web application running on Apache mod_php, PHP-FPM, LiteSpeed, or similar persistent-worker SAPIs, and downstream products including Palo Alto Networks PAN-OS, Siemens RUGGEDCOM APE1808, and numerous NAS and network appliances (PHP Advisory, Red Hat).

CVE-2026-109619 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on October 26, 2026, with a federal patch deadline of October 29, 2026 (CISA KEV). Amazon's MadPot threat intelligence identified exploitation attempts four days before public disclosure (around October 17, 2026). Multiple high-confidence proof-of-concept exploits are publicly available, including multi-stage heap-spray frameworks targeting mod_php and PHP-FPM. The EPSS score is 0.99997 (extremely high probability of exploitation). Threat actors attributed to APT10 (China-linked) and Lazarus Group (DPRK) have been observed exploiting this vulnerability. Cloudflare reported millions of exploitation attempts within hours of disclosure, and honeypots recorded successful shell access. Mirai botnet operators have also attempted to weaponize the flaw (Feedly TI, CISA).

1. Reconnaissance: Identify internet-facing PHP servers (Apache mod_php or PHP-FPM) running vulnerable versions (PHP < 8.2.35, < 8.3.36, < 8.4.27, < 8.5.12) using Shodan, Censys, or HTTP header fingerprinting tools.
2. Producer request – trigger stale state: Send a crafted multipart POST request with a PHP_SESSION_UPLOAD_PROGRESS field and a forged PHPSESSID cookie. Include a large number of file parts with oversized filenames or a large filler part designed to exhaust memory_limit during session decode/encode. This causes PHP to OOM-bail during pre-RINIT session initialization, leaving BG(unserialize) or BG(serialize) context pointers dangling into freed request memory.
3. Stall the upload: Deliver the multipart body in two chunks with a deliberate delay (≥1 second) between them using raw socket or FastCGI connections, ensuring the session upload-progress update runs and publishes state before the OOM occurs.
4. Consumer request – heap spray: Send a follow-up "fire" request to the same worker, spraying the freed allocator bins with forged PHP internal structures (e.g., zend_reference, zend_array, zend_string, zend_execute_data) containing a shell command string and a pointer to zif_system (derived from a leaked zval_ptr_dtor offset or via in-band heap leak from Set-Cookie headers).
5. Trigger destructor: The stale pDestructor pointer in the reclaimed heap object is invoked as zif_system, executing the attacker-supplied OS command as the web server user.
6. Verify execution: Poll for a proof file (e.g., id>/out/p) or check for uid= markers in the response to confirm code execution (PHP Advisory, Feedly TI).

• Network: Unusual multipart POST requests with PHP_SESSION_UPLOAD_PROGRESS field and attacker-controlled PHPSESSID values; requests with very large numbers of file parts or oversized filenames; chunked multipart bodies with deliberate stalls; outbound connections from the PHP/web server process to unknown IPs; exploitation attempts logged at php2shell.delftintellab.com honeypot (66,000+ requests observed).
• Logs: PHP error logs showing Allowed memory size exhausted errors during multipart parsing; repeated warnings or deprecation notices before target scripts execute; Apache/nginx access logs showing multipart POST requests to any PHP endpoint with PHP_SESSION_UPLOAD_PROGRESS in the body; FPM logs showing worker restarts or child process deaths during request startup.
• File System: Unexpected files written by the web server user (e.g., proof files, web shells); new cron jobs or scheduled tasks created by www-data or equivalent; modified PHP session files in /tmp/sessions/ or configured session save path with serialized object payloads.
• Process: Unusual child processes spawned by the PHP/Apache worker (e.g., /bin/bash, curl, wget, python, nc); SIGSEGV or SIGBUS signals in worker processes; worker processes consuming abnormal memory before crashing.
• Threat Intelligence: Source IPs associated with mass scanning for PHP upload-progress endpoints; PHP_SESSION_UPLOAD_PROGRESS in POST body combined with large Content-Length values; Mirai-variant C2 callback attempts from web servers (Feedly TI, CISA).

Primary remediation: Upgrade PHP to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or later). This is the only fully reliable fix (PHP Advisory). Red Hat has issued RHSA-2026:87080 (RHEL 8), RHSA-2026:87151 (RHEL 9), and multiple EUS/SAP advisories (Red Hat).

Partial configuration mitigations (do not cover all attack paths):

• Set session.upload_progress.enabled=0 in php.ini (not via ini_set()) and restart all workers — removes the confirmed session upload-progress consumer path.
• Set fatal_error_backtraces=0 (PHP 8.5 only) — removes the confirmed fatal backtrace producer.
• Set pm.max_requests=1 in PHP-FPM pool configuration — prevents stale state from surviving across requests (significant performance impact).
• Deploy the unofficial php_uploadprogress_guard PHP extension (Hosted Power) as a stopgap for unpatched systems (php_uploadprogress_guard).
• Apply WAF rules (AWS WAF, Cloudflare, Azure WAF) to block or monitor PHP_SESSION_UPLOAD_PROGRESS in multipart POST bodies.

Federal agencies were required to patch by October 29, 2026 per CISA BOD 22-01.

The vulnerability, dubbed "PHP2Shell," triggered one of the largest coordinated cybersecurity responses in recent memory. The PHP Foundation published a detailed advisory and blog post explaining the disclosure process and plans to strengthen PHP security (PHP Foundation). The embargo was broken early by a consultant who inadvertently disclosed details before the patch was released, accelerating attacker timelines. Cloudflare's CEO reported exploit attempts escalating from thousands to millions within hours of disclosure. NCSC (UK), NSA, FBI, CISA, ENISA, and cybersecurity agencies across Europe, Asia-Pacific, and Africa issued urgent advisories. Security researchers from Wiz, OpenAI (using GPT-5.6 Sol), Google, and Amazon credited AI-assisted research with discovering the vulnerabilities. Wikipedia, government websites across the Netherlands, UK, Japan, and other countries took services offline preemptively. The Register, Wired, Ars Technica, and major tech outlets provided extensive coverage. Recorded Future attributed early exploitation to APT10, while Gurucul and CYFIRMA identified a suspected DPRK campaign targeting 216 vulnerable PHP hosts (Feedly TI).