跪拜 Guibai
← All articles
PHP · Backend

PHP's 9.2-CVSS RCE: Installing the Patch Is Not the Same as Running It

By ServBay ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

A CVSS 9.2 RCE with a public patch window puts operational risk on any PHP shop, and multi-version hosting turns that risk into a verification problem: unpatched workers can keep accepting requests long after the update command succeeds. The four-step check is what separates having the fix downloaded from having the fix in the request path.

Summary

Two remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2. The patch release window is 22:00 Beijing time on October 21, according to official advance notice and CERT-EU. Teams on Hacker News are already focused on the lag between distribution builds and patch delivery, and on legacy PHP projects with no upstream support that cannot safely jump major versions. ServBay has shipped patch packages for both current and old PHP branches, but the harder issue is proving the patched binary is what actually serves traffic.

On a single machine, PHP runs through at least three independent paths: the CLI resolved by PATH, PHP-FPM workers behind Nginx or Apache via fastcgi_pass, and long-running queue workers managed by Supervisor or Systemd. Upgrading a package on disk does not reload a running php-fpm master process or interrupt resident queue processes. A php -v check only reports what the current shell's PATH points to; it says nothing about the FPM socket a site binds to or the memory image of a Laravel Queue or Swoole worker.

Recommended verification covers installed binaries and package versions, each site's FastCGI binding to the patched branch, restarts of FPM and queue workers, and runtime evidence collected through a loopback-only script. The /proc/PID/exe link reveals a process still running a replaced binary with a (deleted) marker. The same checklist doubles as evidence for audits and handoffs in mixed-version environments.

Takeaways
— Two remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2.
— The patch release window is 22:00 Beijing time on October 21, per official notice and CERT-EU.
— On one machine, PHP can run through three independent chains: CLI, PHP-FPM, and resident queue workers such as Laravel Queue, Swoole, or RoadRunner.
— Updating the binary on disk does not reload a running php-fpm process; a (deleted) suffix in /proc/PID/exe shows a process still maps the old binary.
— Legacy projects without upstream patch support can stay on their old branch by using a per-project version isolation tool like ServBay to get the security patch.
— The verification checklist walks through package installed, site selected, process switched, and regression passed.
— A loopback-only script that returns PHP_SAPI and PHP_VERSION and is deleted immediately verifies the web path without exposing phpinfo.
— Queue workers only load the patched interpreter after an explicit restart such as php artisan queue:restart or supervisorctl restart all.
Conclusions

The practical exposure is uneven: supported branches have a clear patch path, while legacy projects have no upstream fix unless they use a third-party channel like ServBay.

php -v is a weak health check in multi-version environments because it reflects PATH resolution rather than the request path; process-level evidence is the only signal that matters.

Per-project PHP version isolation turns legacy compatibility into a patch-management problem, which is more tractable than forcing a risky major upgrade.

The /proc/PID/exe (deleted) marker is a cheap operational signal; it turns an invisible stale process into an auditable fact.

Concepts & terms
PHP-FPM
PHP's FastCGI Process Manager; a long-running daemon that executes PHP scripts for web requests forwarded by Nginx or Apache. It has a master process and worker processes, and workers must be reloaded to pick up new binary versions.
fastcgi_pass
An Nginx directive that forwards dynamic HTTP requests to a FastCGI backend such as PHP-FPM, using either a TCP port like 127.0.0.1:9000 or a Unix domain socket like /run/php/php8.2-fpm.sock.
Queue worker
A long-lived PHP process that consumes background jobs for frameworks such as Laravel Queue, Symfony Messenger, Swoole, and RoadRunner. It holds the PHP interpreter in memory, so it must be explicitly restarted after a PHP update.
/proc/PID/exe
A Linux procfs symlink that points to the executable mapped by a running process. When the file on disk has been replaced, the link shows '(deleted)', meaning the process is still executing the old binary.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗