Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)

Original title: CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)

Full Disclosure ()
Read at seclists.org
Part of a story covered by 21 sourcesCISA lists exploited PHP2Shell flaws; agencies must patch by Oct. 29Merged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.

A Full Disclosure post describes CVE-2026-109618, a pointer underflow in PHP's CGI SAPI that the author says enables unauthenticated remote code execution. It affects all PHP versions from 5.x through 8.4.26 when cgi.fix_pathinfo=1, which the post calls the default. Fixes are given as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, scheduled for October 21, 2026, while PHP 8.1 and earlier receive no fix because they are end of life. The post compares it to CVE-2019-11043 and says the CGI SAPI never received the equivalent fix.

Unconfirmed: The CVSS score, impact, and October 21 fix schedule are claims in the post; exploitation is not stated.

Key facts
  • The title gives the issue a CVSS score of 9.2.
  • cgi.fix_pathinfo=1 is described as the default configuration.
  • Fixed releases named are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
  • PHP 8.1 and earlier are end of life and get no fix.
  • The post says the CGI SAPI lacked the 2019 PHP-FPM class of fix.
Security assessment · AI, from the article

Impact: Unauthenticated remote code execution via PHP CGI

ProductAffectedFixed in
PHP Group PHP5.x through 8.4.26 with cgi.fix_pathinfo=18.5.12, 8.4.27, 8.3.36, 8.2.35
What to do
  1. 1.Upgrade supported PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
  2. 2.Review cgi.fix_pathinfo on PHP CGI deployments still awaiting a fix.
Analyze CVE-2026-109618 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-109618
ATT&CK
T1190 Exploit Public-Facing Application
Tags
phpphp-cgiremote-code-executioncgifix-pathinfo
Vendors
PHP Group
Products
PHP

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109618
OOM longjmp memory flaw enabling RCE in PHP
9.2100%KEVPoC ×25
KEV

From the original article

Posted by jose on Oct 27 CVE-2026-109618: Pointer underflow in PHP's CGI SAPI enables unauthenticated remote code execution. Affected: ALL PHP versions 5. x through 8.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.