Security Center:Best practices: Fix PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

Vulnerability scanning

1. Access the Security Center console - Risk Governance - Vulnerability Management. In the upper-left corner of the page, select the region of your assets: Chinese Mainland or Outside Chinese Mainland.

2. Run a scan:

   1. On the Vulnerabilities page, click Quick Scan (All Servers). In the Vulnerability Scan dialog box, select the vulnerability types to scan and click OK.

   2. View scan tasks

      1. In the upper-right corner of the Vulnerabilities page, click Task Management.

      2. Click Details in the Actions column to view the impact data of the scan task, including Affected Servers, Successful Servers, and Failed Servers.

      3. If the scan is successful, you can view the vulnerability scope in the Status column. If the scan fails, you can view the failure reason in the Status column.

      Note

      Cloud Security Center uses two detection methods: Software Composition Analysis (SCA) (passive detection that collects software version information and compares it against the vulnerability database) and Web Scanner (active verification that sends harmless probe requests to confirm vulnerabilities). The Web Scanner feature is not yet available for assets in the Global (excluding China) region hosted in the Singapore data center.

   3. View scan results: After the scan is complete, search for the CVE IDs (CVE-2026-109618 or CVE-2026-109619) in the vulnerability list to view vulnerability details and affected assets.

3. Configure a periodic scan policy: In the upper-right corner of the Vulnerabilities page, click Vulnerability Settings and configure the following settings.

   Parameter	Description
   Vulnerability scan switch	We recommend that you enable all Linux Software Vulnerability, Windows System Vulnerability, Application Vulnerability, and Urgent Vulnerability scan switches. After enabling, you can click Management on the right to specify the scan scope (applicable servers) for each vulnerability type.
   YUM/APT Source Configuration	After you enable this option, Alibaba Cloud official YUM/APT sources are preferred when fixing Linux vulnerabilities, which significantly improves the remediation success rate.
   Urgent Vulnerability Scan Cycle	Set the frequency of emergency vulnerability scan tasks. Default scan period: China region: 00:00:00 (UTC+8) to 07:00:00 (UTC+8). Global (excluding China) region: 00:00:00 (UTC+7) to 07:00:00 (UTC+7). Applicable editions/protection levels: Subscription: Advanced, Enterprise, Ultimate. Pay-as-you-go: Comprehensive Host Protection, Hosts and Container Protection.
   Application Vulnerability Scan Cycle	Set the frequency of application vulnerability scan tasks. Default scan period: China region: 00:00:00 (UTC+8) to 07:00:00 (UTC+8). Global (excluding China) region: Uses staggered scheduling and runs in different time slots within 24 hours. Applicable editions/protection levels: Subscription: Enterprise, Ultimate. Pay-as-you-go: Comprehensive Host Protection, Hosts and Container Protection.
   System Vulnerabilities Scanned At	Set the specific time for Linux software vulnerability and Windows system vulnerability scan tasks.
   Retain Invalid Vulnerabilities For	Set the data cleanup cycle for expired vulnerabilities. The system marks vulnerabilities that have not recurred or been handled for a long time as expired and automatically archives them to the Handled list. After the configured cleanup cycle expires, the system permanently deletes them to reduce information noise. Note When Cloud Security Center detects similar vulnerabilities again, alerts are still generated.
   Vulnerability Scan Level	Set the vulnerability risk levels to monitor. The system scans and generates alerts only for vulnerabilities that match the selected level.
   Vulnerability Whitelist Settings	Add specific vulnerabilities that do not need to be handled (for example, due to special business requirements or acceptable risk) to the whitelist so that they are automatically ignored in subsequent scans. Note After adding a vulnerability whitelist rule, you can manage it (edit or delete) in Vulnerability Settings > Vulnerability Whitelist Settings.

Vulnerability remediation

Alibaba Cloud Linux remediation

Run the following commands to upgrade PHP to the fixed version:

1. Select the upgrade command based on your environment

   • Alibaba Cloud Linux 2

     sudo yum update php -y
     # Verify version ≥ php-5.4.16-48.2.al7
     rpm -q php

   • Alibaba Cloud Linux 3

     sudo yum update php -y
     # Verify version ≥ php-7.4.33-8.0.1.al8
     rpm -q php

   • Alibaba Cloud Linux 4

     sudo yum update php -y
     # Verify version ≥ php-8.3.36-1.alnx4
     rpm -q php

   • Alibaba Cloud Linux 4 (Deb Edition)

     sudo apt update
     sudo apt install --only-upgrade php8.3-cli php8.3-common php8.3-fpm
     # Verify version ≥ 8.3.6-0ubuntu0.24.04.13
     dpkg -l | grep php8.3

2. Restart the PHP service after remediation:

   # PHP-FPM environment
   sudo systemctl restart php-fpm
   
   # Apache mod_php environment
   sudo systemctl restart httpd

Legacy PHP source patches (end-of-life versions)

For PHP 8.1 and earlier versions that are no longer maintained, the PHP security team provides source code patches that contain only the fixes for these vulnerabilities. You can compile and deploy the patched source code on your own. We recommend that you upgrade to a maintained PHP version as soon as possible.

• PHP 7.4: PHP 7.4 source patch

• PHP 8.0: PHP 8.0 source patch

• PHP 8.1: PHP 8.1 source patch

You can also obtain the latest fixed versions from the PHP official download page.

Mitigation for CVE-2026-109618 (RCE via OOM corruption)

This vulnerability is exploited by exhausting memory_limit to trigger OOM. The mitigation is to remove the memory limit or restrict request complexity:

• Remove the memory limit: The administrator must set memory_limit=-1 in php.ini, restart all PHP worker processes, and make sure the configuration is not overridden.

  memory_limit = -1

  Important

  Evaluate the risk of resource exhaustion before removing the memory limit. Do not use RLIMIT_AS or RLIMIT_DATA as an alternative protection.

• Restrict request complexity: Limit the size of the decoded request body, the number of uploads, and input complexity on the frontend.

• Block multipart requests: Applications that do not use multipart forms can block such requests.

Mitigation for CVE-2026-109619 (RCE via stale global state)

This vulnerability is exploited through global state residue across requests. The mitigation is to disable the features that retain such state:

• Disable session upload progress: Set the following in php.ini:

  session.upload_progress.enabled = 0

  Note

  Disabling this feature may affect upload progress display.

• Disable fatal error backtraces (PHP 8.5): In PHP 8.5, you can also set fatal_error_backtraces=0 as a mitigation.

• Limit requests per worker (PHP-FPM): After evaluating the performance impact, you can set pm.max_requests=1 in PHP-FPM to reduce cross-request state reuse.

Confirmed exploitation path: session.upload_progress is only one of the confirmed trigger paths. The preceding measures cannot cover all cross-request state issues.

General configuration requirements

• All preceding configurations must be enforced by the administrator in php.ini. Do not rely on ini_set() in application code or .user.ini settings in PHP-FPM.

• Restart all affected PHP worker processes after the modification to make the configurations take effect.