ASA-202610-2 log generated external raw

Arch Linux Security Advisory ASA-202610-2 ========================================= Severity: Critical Date : 2026-10-21 CVE-ID : CVE-2026-109618 CVE-2026-109619 Package : php-legacy Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2910 Summary ======= The package php-legacy before version 8.3.36-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.3.36-1. # pacman -Syu "php-legacy>=8.3.36-1" The problems have been fixed upstream in version 8.3.36. Workaround ========== If you cannot update immediately: while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe. RCE via OOM corruption (CVE-2026-109618): - Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path. - Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length. - Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure. RCE via stale global state (CVE-2026-109619): - Set session.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants. - On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only. - Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors or @ does not help. - Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup. Description =========== - CVE-2026-109618 (arbitrary code execution) PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, request memory is temporarily reachable before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves the request memory in an invalid state. The failed allocation does not need to be related to the invalid memory. The request shutdown procedure may then read or branch on it. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). - CVE-2026-109619 (arbitrary code execution) PHP contains various global state, such as error, session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, session and error handling operations run before normal initialization of the next request. They inadvertently access stale state not reset by the previous request before initialization has a chance to replace it, causing a use after free. A strategically crafted heap layout can produce full remote code execution (RCE). Impact ====== A remote unauthenticated attacker can execute arbitrary code on the affected host with the privileges of the PHP worker by sending specially crafted HTTP requests. References ========== https://www.php.net/archive/2026.php#2026-10-21-4 https://www.php.net/archive/2026.php#2026-10-21-5 https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp https://security.archlinux.org/CVE-2026-109618 https://security.archlinux.org/CVE-2026-109619