【資安漏洞預警】PHP存在高風險安全漏洞(CVE-2026-109618與CVE-2026-109619)，請儘速確認並進行處置

【行政公告】

公告單位	圖資處網路系統組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】PHP存在高風險安全漏洞(CVE-2026-109618與CVE-2026-109619)，請儘速確認並進行處置【Security Vulnerability Alert】PHP has high-risk security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), please confirm and take action as soon as possible
公告內容	轉發國家資安資訊分享與分析中心資安訊息警訊 NICS-ANA-2026-0000952 [內容說明] 研究人員發現PHP存在使用釋放後記憶體(Use After Free)漏洞(CVE-2026-109618與CVE-2026-109619)，攻擊者可透過傳送特製之multipart/form-data HTTP請求，於未經身分鑑別之情況下，於伺服器底層執行任意程式碼，網路上已出現本漏洞概念驗證程式(PoC)，請儘速確認並進行處置。 [影響平台] 已停止維護(EOL)之版本： PHP 5.4.x至5.6.x之所有版本 PHP 7.0.x至7.4.x之所有版本 PHP 8.0.x至PHP 8.1.x之所有版本官方仍支援之版本： PHP 8.5.11(含)以下版本 PHP 8.4.26(含)以下版本 PHP 8.3.35(含)以下版本 PHP 8.2.34(含)以下版本註：WordPress、Drupal、Joomla及Magento等內容管理系統之底層架構多使用PHP運作，建議盤點與儘速進行處置。 [建議措施] 官方將針對漏洞釋出修補或更新，建議系統管理者儘速將PHP升級至下列受支援之最新安全版本： PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 官方更新公告與下載網址： https://www.php.net/downloads.php 註：PHP 8.1(含)以下版本因官方已停止維護(EOL)，將不會獲得官方修補更新，建議儘速升級至上述仍支援之版本。 [參考資料] 1. https://nvd.nist.gov/vuln/detail/CVE-2026-109618 2. https://nvd.nist.gov/vuln/detail/CVE-2026-109619 3. https://www.php.net/archive/2026.php#2026-10-20-1 4. https://www.php.net/downloads.php Forwarded National Information and Analysis Center for Cyber Security Cybersecurity Information Alert NICS-ANA-2026-0000952 [Description] Researchers have discovered Use After Free vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP. Attackers can send specially crafted multipart/form-data HTTP requests to execute arbitrary code at the server level without authentication. Proof-of-Concept (PoC) code for these vulnerabilities has appeared online. Please confirm and take action as soon as possible. [Affected Platforms] Versions that have reached End of Life (EOL): All versions of PHP 5.4.x to 5.6.x All versions of PHP 7.0.x to 7.4.x All versions of PHP 8.0.x to PHP 8.1.x Versions still supported by the official vendor: PHP versions 8.5.11 and earlier PHP versions 8.4.26 and earlier PHP versions 8.3.35 and earlier PHP versions 8.2.34 and earlier Note: The underlying architecture of content management systems such as WordPress, Drupal, Joomla, and Magento often relies on PHP. It is recommended to inventory affected systems and take action as soon as possible. [Recommended Measures] The official vendor will release patches or updates for the vulnerabilities. System administrators are advised to upgrade PHP to the latest supported secure versions listed below as soon as possible: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 Official update announcements and download URL:https://www.php.net/downloads.php Note: PHP 8.1 and earlier versions have reached End of Life (EOL) and will not receive official patches or updates. It is recommended to upgrade to one of the supported versions listed above as soon as possible. [References] 1. https://nvd.nist.gov/vuln/detail/CVE-2026-109618 2. https://nvd.nist.gov/vuln/detail/CVE-2026-109619 3. https://www.php.net/archive/2026.php#2026-10-20-1 4. https://www.php.net/downloads.php
相關訊息
公告時間	2026/10/22 至 2027/4/22	點閱次數	367