轉發 國家資安資訊分享與分析中心 資安訊息警訊 NICS-ANA-2026-0000952
[內容說明]
研究人員發現PHP存在使用釋放後記憶體(Use After Free)漏洞(CVE-2026-109618與CVE-2026-109619)，攻擊者可透過傳送特製之multipart/form-data HTTP請求，於未經身分鑑別之情況下，於伺服器底層執行任意程式碼，網路上已出現本漏洞概念驗證程式(PoC)，請儘速確認並進行處置。
[影響平台]
已停止維護(EOL)之版本：
PHP 5.4.x至5.6.x之所有版本
PHP 7.0.x至7.4.x之所有版本
PHP 8.0.x至PHP 8.1.x之所有版本
官方仍支援之版本：
PHP 8.5.11(含)以下版本
PHP 8.4.26(含)以下版本
PHP 8.3.35(含)以下版本
PHP 8.2.34(含)以下版本
註：WordPress、Drupal、Joomla及Magento等內容管理系統之底層架構多使用PHP運作，建議盤點與儘速進行處置。
[建議措施]
官方將針對漏洞釋出修補或更新，建議系統管理者儘速將PHP升級至下列受支援之最新安全版本：
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
官方更新公告與下載網址：
https://www.php.net/downloads.php
註：PHP 8.1(含)以下版本因官方已停止維護(EOL)，將不會獲得官方修補更新，建議儘速升級至上述仍支援之版本。
[參考資料]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-109618
2. https://nvd.nist.gov/vuln/detail/CVE-2026-109619
3. https://www.php.net/archive/2026.php#2026-10-20-1
4. https://www.php.net/downloads.php
Forwarded National Information and Analysis Center for Cyber Security Cybersecurity Information Alert NICS-ANA-2026-0000952
[Description]
Researchers have discovered Use After Free vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP. Attackers can send specially crafted multipart/form-data HTTP requests to execute arbitrary code at the server level without authentication. Proof-of-Concept (PoC) code for these vulnerabilities has appeared online. Please confirm and take action as soon as possible.
[Affected Platforms]
Versions that have reached End of Life (EOL): All versions of PHP 5.4.x to 5.6.x All versions of PHP 7.0.x to 7.4.x All versions of PHP 8.0.x to PHP 8.1.x
Versions still supported by the official vendor: PHP versions 8.5.11 and earlier PHP versions 8.4.26 and earlier PHP versions 8.3.35 and earlier PHP versions 8.2.34 and earlier
Note: The underlying architecture of content management systems such as WordPress, Drupal, Joomla, and Magento often relies on PHP. It is recommended to inventory affected systems and take action as soon as possible.
[Recommended Measures]
The official vendor will release patches or updates for the vulnerabilities. System administrators are advised to upgrade PHP to the latest supported secure versions listed below as soon as possible: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35
Official update announcements and download URL:https://www.php.net/downloads.php
Note: PHP 8.1 and earlier versions have reached End of Life (EOL) and will not receive official patches or updates. It is recommended to upgrade to one of the supported versions listed above as soon as possible.
[References]
1. https://nvd.nist.gov/vuln/detail/CVE-2026-109618
2. https://nvd.nist.gov/vuln/detail/CVE-2026-109619
3. https://www.php.net/archive/2026.php#2026-10-20-1
4. https://www.php.net/downloads.php