A tale of two PHP remote vulnerabilities
Summary
Calif Research documents two PHP memory-limit remote vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that enable pre-auth RCE via mod_php and PHP-FPM. The write-up traces the history from 2004 through 2026, explains exploitation vectors, and provides patch guidance and mitigations, including disabling session upload progress and memory_limit adjustments. It highlights how startup/shutdown sequencing and the PHP unserializer pattern enable attacker-controlled state to survive across requests.