In response to the recently disclosed PHP Session Upload Progress Use-After-Free vulnerabilities (CVE-2026-109618 / CVE-2026-109619), TeamT5 has identified the associated attack techniques and will continue monitoring suspicious activities across customer environments through ThreatSonar Anti-Ransomware and MDR services to help mitigate potential security risks.

Vulnerability Description

CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

  • Official security advisory: Link

CVE-2026-109619

PHP has various global states that temporarily point into request memory. In some scenarios, the global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

  • Official security advisory: Link

TeamT5 strongly recommends that enterprises update affected installations to the officially patched versions in accordance with PHP security advisories.

To help customers assess their exposure and strengthen their security posture, TeamT5 provides the following threat detection and asset inventory capabilities.

1. ThreatSonar Anti-Ransomware: Continuous Monitoring of PHP-Related Attack Activities

ThreatSonar Anti-Ransomware includes multiple detection rules designed to identify suspicious PHP-related activities, including malicious command execution, WebShell activity, and reverse shell connections.

The relevant detection rules include:

  • php command reverse shell

  • php_cgi_spawn_shell

  • php_cgi_shell_exec_lolbas

  • php-cgi webshell lolbas

  • W3wp Suspicious php-cgi.exe process execution

TeamT5 will continue tracking attack techniques and threat intelligence associated with these vulnerabilities, monitoring suspicious activities through ThreatSonar, and evaluating enhancements to detection capabilities based on emerging threats.

2. MDR Services: Proactive PHP Asset Inventory and Patch Notifications

For customers subscribed to TeamT5 MDR services, our team will assist in identifying endpoints running PHP software within their environments.

Based on the inventory results, TeamT5 will notify customers through established communication channels to verify their PHP versions and apply the necessary security patches.

By combining asset visibility with continuous threat monitoring, we aim to help customers prioritize potentially affected systems and reduce the risk of vulnerability exploitation.

3. ThreatSonar’s Threat Hunter: Self-Service PHP Asset Discovery

Customers can also use the Threat Hunter feature in the ThreatSonar platform to independently identify endpoints that may have PHP installed or running.

Recommended search methods:

  • Windows: Search for Hunting Tag "Co The Php Group"

  • Linux: Search for filename"~php-fpm"

These searches can help customers identify potentially affected endpoints, verify installed PHP versions, assess vulnerability exposure, and plan the necessary remediation activities.

Please note that search results depend on the endpoint information collected by ThreatSonar. The absence of search results does not necessarily indicate that PHP is not installed. We recommend cross-checking the results against operating system package inventories and installed software records.

By combining ThreatSonar Anti-Ransomware threat detection, ThreatSonar’s Threat Hunter asset discovery, and proactive MDR monitoring services, TeamT5 helps organizations identify potential vulnerability exposure, accelerate remediation efforts, and detect suspicious activities at an early stage to strengthen their overall security posture.

Please note that the existing PHP-related detection rules are primarily designed to identify suspicious attack behaviors and are not dedicated exploit detection rules specifically developed for these CVEs. Therefore, the absence of related alerts does not guarantee that a system is free from vulnerabilities or potential compromise.