Critical PHP RCE Vulnerabilities Actively Exploited for Root Access via Kernel Chain
Written by AI from the linked story. Not reviewed by an editor. How this works
Two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), scoring 9.2 on the CVSS scale, are being actively exploited in the wild. Attackers exploit unsafe memory handling — specifically out-of-memory errors and fatal error handling that leaves global memory pointing to freed regions — to execute arbitrary code. These flaws are being chained with a Linux kernel privilege-escalation vulnerability to achieve full root access, with confirmed targeting of internet-exposed PAN-OS management interfaces. This incident highlights the compounding danger of unpatched application-layer vulnerabilities when combined with kernel-level weaknesses, and the critical importance of restricting public exposure of management interfaces.
Tactical Insight
Immediate actions
- Apply the vendor-released PHP patches for CVE-2026-109618 and CVE-2026-109619 to all affected systems without delay.
- Immediately restrict or remove internet exposure of PAN-OS and other network appliance management interfaces by placing them behind VPN or jump hosts.
- Run authenticated vulnerability scans across all internet-facing assets to identify unpatched PHP instances.
Long-term improvements
- Establish a formal emergency patching SLA (e.g., 24–72 hours) for critical CVSS 9.0+ vulnerabilities affecting internet-facing systems.
- Maintain a continuously updated, authoritative inventory of all software versions, including scripting runtimes like PHP, across the environment.
- Implement network segmentation to isolate management planes from production and internet-facing networks.
Detection measures
- Deploy runtime application monitoring and anomaly detection to flag unusual memory errors, process spawning, or privilege escalation attempts on PHP-hosting servers.
- Enable and centrally aggregate logs from all management interfaces and web servers to detect exploitation indicators such as unexpected shell execution or root-level process creation.