As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
A pointer underflow vulnerability in PHP's CGI SAPI (CVE-2026-109618, CVSS 9.2) allows unauthenticated remote code execution on all PHP versions 5.x through 8.4.26 when cgi.fix_pathinfo is enabled by default. The flaw mirrors CVE-2019-11043, which affected PHP-FPM and was patched in 2019, but the CGI SAPI variant was never addressed. Patches are scheduled for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 as of October 21, 2026, with PHP 8.1 and earlier receiving no updates.
Why it matters: Organizations running PHP with CGI SAPI in default configuration face immediate RCE exposure; apply patches to 8.2.35 and later when available, or disable cgi.fix_pathinfo, and retire unsupported PHP 8.1 or earlier instances.
- Source published
- First seen by Cybersecurity Tracker