PHP2shell Vulnerabilities CVE-2026-109618 & CVE-2026-109619 in Security Analytics

Products

• Security Analytics

Issue/Introduction

Is Security Analytics vulnerable to PHP2shell Vulnerabilities CVE-2026-109618 & CVE-2026-109619?

Environment

CVE	Affected Versions(s)
CVE-2026-109618	8.2.8,  8.3.1,  8.3.2,  8.4.1.2, 8.4.1.3
CVE-2026-109619	8.2.8,  8.3.1,  8.3.2,  8.4.1.2, 8.4.1.3

Cause

CVE-2026-109618: This PHP vulnerability arises from memory limit handling during request parsing: PHP marks certain state as ready for use before all required memory allocations finish, and if an allocation then fails due to memory exhaustion, that incomplete state isn't rolled back, so later cleanup operations treat the uninitialized memory as valid, causing memory corruption that an unauthenticated attacker could trigger via crafted HTTP requests to achieve remote code execution against mod_php in its default configuration (and against FPM via application-stage paths); the issue is rated Important rather than Critical because reliable exploitation needs precise heap manipulation and timing, and on standard Red Hat Enterprise Linux deployments—which use PHP-FPM rather than mod_php—FPM workers typically exit on early initialization failures before reaching the corrupted structures, so remote code execution in practice usually requires non-default behavior such as parsing a second request body during script execution.

CVE-2026-109619: This PHP vulnerability stems from error handling and worker process state that persists across requests but still points to memory tied to a single request; when a fatal error interrupts cleanup and PHP either continues cleanup or reuses the worker for a new request, later code can operate on this stale state after its memory has already been freed, creating a use-after-free that an unauthenticated attacker can trigger (primarily against mod_php, with FPM conditionally affected) to potentially corrupt memory and achieve remote code execution—though because exploitation depends on hitting a precise out-of-memory condition during request processing, its severity falls just short of Critical despite requiring no authentication to reach.

Resolution

To fully resolve this issue, apply the upcoming product software updates upon availability.

• For release levels prior to 8.3.2, a patch is scheduled for inclusion in version 8.3.2 during the final week of October 2026; updating to this version is advised.  If you are running any version prior to 8.3.2, you will need to upgrade to 8.3.2 to receive the updated binaries.
• For environments on version 8.4.1.2 or later, a fix is planned for version 8.4.1.4 during the second week of November 2026.

Additional Information