#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Detects exposure to CVE-2026-109619 (PHP stale global state use-after-free, "php2shell"). # # DESCRIPTION # CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is a use-after-free in PHP request handling: request-owned # global state (error, session, object and extension state) is not reset before the request heap # is freed, so a later request on the same worker can use the stale pointer. Confirmed paths are # the session upload progress lifecycle (enabled by default) and, on PHP 8.5, fatal error # backtraces; they lead to unauthenticated remote code execution. It affects every PHP that # serves web requests before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. # The script finds the PHP web server interfaces on the host (PHP-FPM, Apache mod_php, # php-cgi, LiteSpeed lsphp, FrankenPHP), reads the PHP version embedded in each binary and # decides whether it is fixed: upstream version, the fixed builds of Ubuntu, Debian and RHEL # (backports), or a package changelog that names the CVE. A vulnerable interface is reported # only if it is in use (running process, enabled service or Apache module loaded) and the # advisory workaround (session.upload_progress.enabled = 0, plus fatal_error_backtraces = 0 on # PHP 8.5, enforced with php_admin_value in every PHP-FPM pool and in Apache) is not in place. # The PHP command line alone is not exposed. # Output: log lines, then exactly one last line # RESULT=CVE-2026-109619|VULNERABLE|TRUE a vulnerable PHP web interface is exposed # RESULT=CVE-2026-109619|VULNERABLE|FALSE not exposed (or an error, with exit code 1) # Exit code 0 when the check ran; 1 only on a real error (invalid configuration, version not # readable). Linux only (Debian/Ubuntu, RHEL family and others with the same tools). # Sources: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp, # https://ubuntu.com/security/CVE-2026-109619, https://security-tracker.debian.org/tracker/CVE-2026-109619, # https://access.redhat.com/security/cve/cve-2026-109619 # VARIABLES TO DEFINE: # # REQUIRE_ACTIVE_WEB_SAPI=true # optional — true: only interfaces in use count; false: any installed one # # COUNT_WORKAROUND_AS_MITIGATED=true # optional — true: the advisory workaround makes the host not exposed # # COMMAND_TIMEOUT=60 # optional — maximum seconds for any external command # WARNINGS: # # Read-only: makes no changes. Run as root: reading PHP-FPM pool settings (php-fpm -tt) # # and other users' processes requires it; without root the script ends in error. # # The workaround closes the confirmed paths only; updating PHP is the complete fix. # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== # ---------------- Configuration (edit only this block) ---------------- # true = only PHP web interfaces in use count (running, enabled service or Apache module loaded); false = any installed. REQUIRE_ACTIVE_WEB_SAPI=true # true = an interface with the advisory workaround enforced is reported as not exposed (update still recommended). COUNT_WORKAROUND_AS_MITIGATED=true # Maximum seconds for any single external command. COMMAND_TIMEOUT=60 # ---------------------------------------------------------------------- set -u set -o pipefail CVE_ID="CVE-2026-109619" # Upstream releases with the fix, one per supported branch (GHSA-6wmf-4rv5-p3rp). Newer branches are fixed. FIXED_UPSTREAM=("8.2.35" "8.3.36" "8.4.27" "8.5.12") LAST_AFFECTED_BRANCH="8.5" # Distribution builds with the fix backported: " " (Ubuntu USN-8948-1/-2, Debian DSA-6574-1/DLA-4848-1). DEB_FIXED=("php8.5 8.5.9-0ubuntu2.1" "php8.5 8.5.4-0ubuntu1.5" "php8.3 8.3.6-0ubuntu0.24.04.13" "php8.1 8.1.2-1ubuntu2.28" "php7.4 7.4.3-4ubuntu2.29+esm5" "php7.2 7.2.24-0ubuntu0.18.04.17+esm14" "php7.0 7.0.33-0ubuntu0.16.04.16+esm22" "php5 5.5.9+dfsg-1ubuntu4.29+esm18" "php8.2 8.2.35-1~deb12u1" "php8.4 8.4.27-1~deb13u1") # " " (Red Hat CSAF for CVE-2026-109618/109619, same builds). RPM_FIXED=("php 8.0.30-8.el9_8.1") # A package changelog naming this ID means the fix was backported. CHANGELOG_PATTERN="CVE-2026-109619" # Settings of the advisory workaround: "=[@]". WORKAROUND_SETTINGS=("session.upload_progress.enabled=0" "fatal_error_backtraces=0@8.5") # Where PHP web interfaces are looked for: "|". SAPI_GLOBS=("fpm|/usr/sbin/php-fpm*" "fpm|/usr/local/sbin/php-fpm*" "fpm|/opt/remi/php*/root/usr/sbin/php-fpm" "apache|/usr/lib/apache2/modules/libphp*.so" "apache|/usr/lib64/httpd/modules/libphp*.so" "apache|/usr/lib/httpd/modules/libphp*.so" "apache|/usr/local/apache2/modules/libphp*.so" "cgi|/usr/bin/php-cgi*" "cgi|/usr/local/bin/php-cgi*" "cgi|/opt/remi/php*/root/usr/bin/php-cgi" "lsapi|/usr/local/lsws/lsphp*/bin/lsphp" "lsapi|/usr/bin/lsphp*" "frankenphp|/usr/local/bin/frankenphp" "frankenphp|/usr/bin/frankenphp") APACHE_CONF_GLOBS=("/etc/apache2/apache2.conf" "/etc/apache2/ports.conf" "/etc/apache2/conf-enabled/*.conf" "/etc/apache2/mods-enabled/*.conf" "/etc/apache2/mods-enabled/*.load" "/etc/apache2/sites-enabled/*" "/etc/httpd/conf/httpd.conf" "/etc/httpd/conf.d/*.conf" "/etc/httpd/conf.modules.d/*.conf") log() { printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*"; } # Verdict: TRUE = exposed, FALSE = not exposed. Exit 0: the check ran as intended. finish() { printf 'RESULT=%s|VULNERABLE|%s\n' "$CVE_ID" "$1" exit 0 } # Real error (invalid configuration, unexpected failure): FALSE and exit 1 (cve-scripts.md). fail_error() { log "ERROR: $*" printf 'RESULT=%s|VULNERABLE|FALSE\n' "$CVE_ID" exit 1 } run_bounded() { timeout "$COMMAND_TIMEOUT" "$@"; } # 0 if version $1 >= $2 (dotted numbers). ver_ge() { [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n 1)" = "$2" ]; } # Upstream part of a Debian version: no epoch, no revision. deb_upstream() { local v="${1#*:}"; printf '%s\n' "${v%-*}"; } discover_sapis() { # Prints "|" once per PHP web interface installed. local entry sapi pattern f real local -A seen=() shopt -s nullglob for entry in "${SAPI_GLOBS[@]}"; do sapi=${entry%%|*}; pattern=${entry#*|} # shellcheck disable=SC2206 # the glob must expand here local matches=($pattern) for f in "${matches[@]}"; do [ -f "$f" ] || continue case "$f" in *.dpkg-*|*.rpmnew|*.rpmsave|*.bak) continue ;; esac real=$(readlink -f -- "$f") || continue [ -n "${seen[$real]:-}" ] && continue seen[$real]=1 printf '%s|%s\n' "$sapi" "$real" done done shopt -u nullglob } php_version_of() { # The version compiled into the binary ("X-Powered-By: PHP/"). grep -aoE -m 1 'X-Powered-By: PHP/[0-9]+\.[0-9]+\.[0-9]+' -- "$1" 2>/dev/null | head -n 1 | sed 's#.*/##' } upstream_fixed() { # 0 if the upstream version already contains the fix. local v="$1" branch fixed branch=$(printf '%s\n' "$v" | cut -d. -f1,2) if ver_ge "$branch" "$LAST_AFFECTED_BRANCH" && [ "$branch" != "$LAST_AFFECTED_BRANCH" ]; then return 0; fi for fixed in "${FIXED_UPSTREAM[@]}"; do [ "$(printf '%s\n' "$fixed" | cut -d. -f1,2)" = "$branch" ] || continue ver_ge "$v" "$fixed" && return 0 done return 1 } package_fixed() { # 0 if the distribution package that owns file $1 has the fix backported. Prints the package used. local path="$1" pkg ver src entry name fixed rel if command -v dpkg-query >/dev/null 2>&1 && pkg=$(dpkg -S -- "$path" 2>/dev/null | head -n 1 | sed 's/: .*//; s/:.*//') && [ -n "$pkg" ]; then IFS='|' read -r ver src < <(dpkg-query -W -f='${Version}|${source:Package}\n' "$pkg" 2>/dev/null) printf '%s %s\n' "$pkg" "$ver" [ -n "${ver:-}" ] || return 1 for entry in "${DEB_FIXED[@]}"; do name=${entry%% *}; fixed=${entry#* } [ "$name" = "$src" ] || continue [ "$(deb_upstream "$ver")" = "$(deb_upstream "$fixed")" ] || continue dpkg --compare-versions "$ver" ge "$fixed" && return 0 done if [ -f "/usr/share/doc/$pkg/changelog.Debian.gz" ] && zgrep -q -- "$CHANGELOG_PATTERN" "/usr/share/doc/$pkg/changelog.Debian.gz" 2>/dev/null; then return 0 fi return 1 fi if command -v rpm >/dev/null 2>&1 && pkg=$(rpm -qf --qf '%{NAME} %{VERSION}-%{RELEASE} %{SOURCERPM}\n' -- "$path" 2>/dev/null | head -n 1) && [ -n "$pkg" ] && [[ "$pkg" != *"not owned"* ]]; then read -r name ver src <<<"$pkg" printf '%s %s\n' "$name" "$ver" # Source package name: the source rpm without "--.src.rpm". name=${src%-"$ver".src.rpm} for entry in "${RPM_FIXED[@]}"; do [ "${entry%% *}" = "$name" ] || continue fixed=${entry#* } [ "${fixed%%-*}" = "${ver%%-*}" ] || continue rel=$(rpm --eval "%{lua: print(rpm.vercmp('$ver', '$fixed'))}" 2>/dev/null) [ "${rel:-}" = 0 ] || [ "${rel:-}" = 1 ] && return 0 done # grep -c reads everything: with pipefail, grep -q could stop early and fail the pipeline (SIGPIPE). [ "$(run_bounded rpm -qf --changelog -- "$path" 2>/dev/null | grep -c -- "$CHANGELOG_PATTERN")" -gt 0 ] && return 0 return 1 fi printf '%s\n' "not owned by a package" return 1 } process_running() { # 0 if a process runs the executable $1. local exe p for p in /proc/[0-9]*; do exe=$(readlink "$p/exe" 2>/dev/null) || continue exe=${exe% (deleted)} [ "$exe" = "$1" ] && return 0 done return 1 } unit_uses() { # Prints enabled or active systemd services whose ExecStart runs $1. command -v systemctl >/dev/null 2>&1 || return 0 local u exec while read -r u _; do [ -n "$u" ] || continue exec=$(run_bounded systemctl show -p ExecStart --value "$u" 2>/dev/null) case "$exec" in *"$1 "*|*"$1;"*|*"path=$1 "*) ;; *) continue ;; esac if [ "$(run_bounded systemctl is-enabled "$u" 2>/dev/null)" = enabled ] || run_bounded systemctl is-active --quiet "$u" 2>/dev/null; then printf '%s\n' "$u" fi done < <(run_bounded systemctl list-unit-files --type=service --no-legend --no-pager '*php*' '*fpm*' '*lsws*' '*litespeed*' '*frankenphp*' '*caddy*' 2>/dev/null) } apache_conf_files() { local g f shopt -s nullglob for g in "${APACHE_CONF_GLOBS[@]}"; do # shellcheck disable=SC2206 # the glob must expand here local matches=($g) for f in "${matches[@]}"; do [ -f "$f" ] && printf '%s\n' "$f"; done done shopt -u nullglob } apache_active() { # 0 if Apache loads module $1 and Apache is running or enabled. local mod="$1" base u base=$(basename -- "$mod") [ -n "$(apache_conf_files | xargs -r grep -hsE "^[[:space:]]*LoadModule[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]*${base//./\\.}[[:space:]]*$")" ] || return 1 process_running "$(command -v apache2 2>/dev/null || echo /usr/sbin/apache2)" && return 0 process_running "$(command -v httpd 2>/dev/null || echo /usr/sbin/httpd)" && return 0 command -v systemctl >/dev/null 2>&1 || return 1 for u in apache2 httpd; do [ "$(run_bounded systemctl is-enabled "$u" 2>/dev/null)" = enabled ] && return 0 run_bounded systemctl is-active --quiet "$u" 2>/dev/null && return 0 done return 1 } sapi_active() { # 0 if the interface is in use. Prints why. local sapi="$1" path="$2" units if [ "$sapi" = apache ]; then apache_active "$path" && { echo "module loaded by Apache"; return 0; } echo "module not loaded by an enabled or running Apache"; return 1 fi process_running "$path" && { echo "running process"; return 0; } units=$(unit_uses "$path" | tr '\n' ' ') [ -n "$units" ] && { echo "service ${units% }"; return 0; } echo "not running and no enabled service"; return 1 } settings_for_branch() { # Prints " " for the workaround settings that apply to PHP branch $1. local s key val min for s in "${WORKAROUND_SETTINGS[@]}"; do key=${s%%=*}; val=${s#*=}; min="" case "$val" in *@*) min=${val#*@}; val=${val%@*} ;; esac [ -n "$min" ] && ! ver_ge "$1" "$min" && continue printf '%s %s\n' "$key" "$val" done } same_ini_value() { # Flags may be shown as 0/off/Off or 1/on/On. local a b a=$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]'); b=$(printf '%s' "$2" | tr '[:upper:]' '[:lower:]') case "$a" in off|false|no) a=0 ;; on|true|yes) a=1 ;; esac case "$b" in off|false|no) b=0 ;; on|true|yes) b=1 ;; esac [ "$a" = "$b" ] } fpm_workaround() { # 0 if every pool of PHP-FPM $1 enforces the settings with php_admin_value. 2 on error. Prints details. local bin="$1" branch="$2" dump pools key val pool got missing="" dump=$(run_bounded "$bin" -tt 2>&1) || { echo "php-fpm -tt failed: $(printf '%s' "$dump" | tail -n 1)"; return 2; } dump=$(printf '%s\n' "$dump" | sed -E 's/^\[[^]]*\] NOTICE:[[:space:]]*//') pools=$(printf '%s\n' "$dump" | grep -E '^\[[^]]+\]$' | tr -d '[]' | grep -vx global) [ -n "$pools" ] || { echo "no pools found in php-fpm -tt"; return 2; } while read -r key val; do [ -n "$key" ] || continue while read -r pool; do got=$(printf '%s\n' "$dump" | awk -v p="$pool" -v k="php_admin_value[$key]" ' /^\[[^]]+\]$/ { cur = substr($0, 2, length($0) - 2); next } cur == p && index($0, k) == 1 { v = $0; sub(/^[^=]*=[ \t]*/, "", v); print v; exit }') same_ini_value "${got:-}" "$val" || missing="$missing $pool:$key=${got:-unset}" done <<<"$pools" done < <(settings_for_branch "$branch") if [ -n "$missing" ]; then echo "pools without the enforced setting:$missing"; return 1; fi echo "all pools enforce: $(settings_for_branch "$branch" | tr '\n' ' ')" return 0 } apache_workaround() { # 0 if Apache enforces the settings with php_admin_value/php_admin_flag and nothing sets another value. local branch="$1" key val lines bad="" ok_all=true admin_ok d got while read -r key val; do [ -n "$key" ] || continue lines=$(apache_conf_files | xargs -r grep -hsE "^[[:space:]]*php_(admin_)?(value|flag)[[:space:]]+${key//./\\.}[[:space:]]" | awk '{print $1, $3}') admin_ok=false while read -r d got; do [ -n "${d:-}" ] || continue if same_ini_value "$got" "$val"; then case "$d" in php_admin_*) admin_ok=true ;; esac else bad="$bad $d $key $got;" fi done <<<"$lines" [ "$admin_ok" = true ] || ok_all=false done < <(settings_for_branch "$branch") if [ -n "$bad" ]; then echo "conflicting Apache directives:$bad"; return 1; fi [ "$ok_all" = true ] || { echo "Apache does not enforce the workaround with php_admin_value"; return 1; } echo "Apache enforces: $(settings_for_branch "$branch" | tr '\n' ' ')" return 0 } log "Checking $CVE_ID on $(uname -srm) as $(id -un) (uid $(id -u))" # --- Validate configuration --- case "$REQUIRE_ACTIVE_WEB_SAPI" in true|false) ;; *) fail_error "REQUIRE_ACTIVE_WEB_SAPI must be true or false." ;; esac case "$COUNT_WORKAROUND_AS_MITIGATED" in true|false) ;; *) fail_error "COUNT_WORKAROUND_AS_MITIGATED must be true or false." ;; esac [[ "$COMMAND_TIMEOUT" =~ ^[1-9][0-9]*$ ]] || fail_error "Invalid COMMAND_TIMEOUT '$COMMAND_TIMEOUT'." [ "$(id -u)" -eq 0 ] || fail_error "Root privileges are required to read PHP-FPM pools and other users' processes." # --- Discover PHP web interfaces --- mapfile -t sapis < <(discover_sapis) if [ "${#sapis[@]}" -eq 0 ]; then log "No PHP web server interface installed (PHP-FPM, mod_php, php-cgi, LiteSpeed, FrankenPHP): not exposed." finish FALSE fi exposed=0; errors=0; fixed=0; inactive=0; mitigated=0 for s in "${sapis[@]}"; do sapi=${s%%|*}; path=${s#*|} version=$(php_version_of "$path") if [ -z "$version" ]; then log "[$sapi] $path: PHP version not readable."; errors=$((errors + 1)); continue fi branch=$(printf '%s\n' "$version" | cut -d. -f1,2) if upstream_fixed "$version"; then log "[$sapi] $path: PHP $version contains the fix."; fixed=$((fixed + 1)); continue fi pkginfo=$(package_fixed "$path"); rc=$? if [ "$rc" -eq 0 ]; then log "[$sapi] $path: PHP $version, package $pkginfo has the fix backported."; fixed=$((fixed + 1)); continue fi log "[$sapi] $path: PHP $version is affected (package: $pkginfo)." why=$(sapi_active "$sapi" "$path"); active=$? if [ "$active" -ne 0 ] && [ "$REQUIRE_ACTIVE_WEB_SAPI" = true ]; then log "[$sapi] $path: not in use ($why): not exposed."; inactive=$((inactive + 1)); continue fi [ "$active" -eq 0 ] && log "[$sapi] $path: in use ($why)." if [ "$COUNT_WORKAROUND_AS_MITIGATED" = true ]; then case "$sapi" in fpm) detail=$(fpm_workaround "$path" "$branch"); wrc=$? ;; apache) detail=$(apache_workaround "$branch"); wrc=$? ;; *) detail="no administrative workaround supported for $sapi"; wrc=1 ;; esac if [ "$wrc" -eq 0 ]; then log "[$sapi] $path: workaround in place ($detail). Mitigated, not patched: update PHP."; mitigated=$((mitigated + 1)); continue fi if [ "$wrc" -eq 2 ]; then log "[$sapi] $path: workaround could not be evaluated ($detail)."; errors=$((errors + 1)) else log "[$sapi] $path: workaround not in place ($detail)." fi fi log "[$sapi] $path: EXPOSED to $CVE_ID."; exposed=$((exposed + 1)) done log "Summary: interfaces=${#sapis[@]} exposed=$exposed fixed=$fixed not_in_use=$inactive mitigated_by_workaround=$mitigated errors=$errors" [ "$exposed" -gt 0 ] && finish TRUE [ "$errors" -gt 0 ] && fail_error "$errors PHP interface(s) could not be evaluated." finish FALSE

Description