[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYJkwuBKvV6bg8bV0-CHVfQxMQbo7LUjo9tckcqJpL1M":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"9110b5e8-57b9-43b4-8891-ece49d987ef7","critical-php-rce-vulnerabilities-actively-exploited-for-root-access-via-kernel-chain","b4b10767-1f26-4f22-a25c-fdffdbf40090","Critical PHP RCE Vulnerabilities Actively Exploited for Root Access via Kernel Chain","Two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), scoring 9.2 on the CVSS scale, are being actively exploited in the wild. Attackers exploit unsafe memory handling — specifically out-of-memory errors and fatal error handling that leaves global memory pointing to freed regions — to execute arbitrary code. These flaws are being chained with a Linux kernel privilege-escalation vulnerability to achieve full root access, with confirmed targeting of internet-exposed PAN-OS management interfaces. This incident highlights the compounding danger of unpatched application-layer vulnerabilities when combined with kernel-level weaknesses, and the critical importance of restricting public exposure of management interfaces.","**Immediate actions:**\n- Apply the vendor-released PHP patches for CVE-2026-109618 and CVE-2026-109619 to all affected systems without delay.\n- Immediately restrict or remove internet exposure of PAN-OS and other network appliance management interfaces by placing them behind VPN or jump hosts.\n- Run authenticated vulnerability scans across all internet-facing assets to identify unpatched PHP instances.\n\n**Long-term improvements:**\n- Establish a formal emergency patching SLA (e.g., 24–72 hours) for critical CVSS 9.0+ vulnerabilities affecting internet-facing systems.\n- Maintain a continuously updated, authoritative inventory of all software versions, including scripting runtimes like PHP, across the environment.\n- Implement network segmentation to isolate management planes from production and internet-facing networks.\n\n**Detection measures:**\n- Deploy runtime application monitoring and anomaly detection to flag unusual memory errors, process spawning, or privilege escalation attempts on PHP-hosting servers.\n- Enable and centrally aggregate logs from all management interfaces and web servers to detect exploitation indicators such as unexpected shell execution or root-level process creation.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires essential and important entities to implement vulnerability handling and patching policies, making the failure to patch these critical PHP vulnerabilities a potential compliance breach.","PCI DSS Requirement 6 mandates the development and maintenance of secure systems by applying security patches promptly, which directly applies to the unpatched PHP runtime exploited in these attacks.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule, directly mandating the rapid patching of these critical PHP RCE vulnerabilities.","Running unpatched versions of PHP on internet-facing servers is exactly the scenario OWASP A06 addresses, emphasizing the need to track and update all third-party components including language runtimes.","Routine vulnerability scanning and a defined patching cadence would have identified the critical PHP flaws and driven timely remediation before active exploitation began.","A.8.8 requires timely identification and remediation of technical vulnerabilities, which would have enforced a structured response to these publicly disclosed, actively exploited PHP flaws.","Restricting access to management interfaces so they are not internet-exposed aligns with PR.AA controls, which would have significantly limited the attack surface exploited in this campaign.","published","2026-10-31T20:20:20.799377+00:00","2026-10-31T20:20:20.779+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Funit42.paloaltonetworks.com\u002Fcve-2026-109618-cve-2026-109619\u002F","threat-brief-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619-upd-cb1bde","Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,56],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":53,"name":54,"problem":55},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",{"slug":44,"name":57,"problem":58},"Automated patch management","Known holes get closed in days, not months."]