CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window

Leak hit HN 2026-10-20 15:20Z. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 fix both CVEs. Mechanism: php_request_startup() calls php_hash_environment() (multipart parse, the session.upload_progress callback, php_session_initialize() on the process-wide BG(serialize)/BG(unserialize)) one line before zend_activate_modules() runs basic’s RINIT, which is what zeroes them. CVE-2026-109618 is the exit direction: an OOM longjmp out of the serializer leaves partial state and mod_php runs shutdown anyway. CVE-2026-109619 is the entry direction: the next request on the same worker dereferences that state before RINIT. The 8.5.12 patch adds php_basic_early_rinit(), a PS(in_rfc1867_update) flag that forces incomplete_classes_only inside the window, and removes zend_bailout() from the OOM path. The ordering is unchanged. The post_bytes_processed UAF theory behind most of the 70+ GitHub repos does not fire: the cached array’s refcount walks 2 to 1 and never reaches 0 on instrumented 8.2.34 through 8.5.12 (xuehuolll audit, dinosn lab). Three paths survive 8.5.12: the var_destroy re-entry UAF, the serialize_handler mismatch, and upload-progress session injection. Labs: https://github.com/dinosn/php-cve-2026-10961x-lab-poc and https://github.com/xuehuolll/php2shell-CVE-2026-109618-109619 submitted by /u/TakesThisSeriously [link] [comments]Technical Information Security Content & DiscussionRead More