Arch Linux Security Advisories

[ASA-202505-9] dropbear: arbitrary command execution

2025-05-19T16:51:45.714788+00:00

Arch Linux Security Advisory ASA-202505-9
=========================================

Severity: Medium
Date    : 2025-05-19
CVE-ID  : CVE-2025-47203
Package : dropbear
Type    : arbitrary command execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2874

Summary
=======

The package dropbear before version 2025.88-1 is vulnerable to
arbitrary command execution.

Resolution
==========

Upgrade to 2025.88-1.

# pacman -Syu "dropbear>=2025.88-1"

The problem has been fixed upstream in version 2025.88.

Workaround
==========

None.

Description
===========

dbclient in Dropbear SSH before 2025.88 allows command injection via an
untrusted hostname argument, because a shell is used.

Impact
======

A remote attacker can craft a malicious hostname to execute arbitrary
commands on a system using dbclient if the hostname is passed without
proper sanitization.

References
==========

https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2025q2/002385.html
https://security.archlinux.org/CVE-2025-47203

[ASA-202505-10] python-django: denial of service

2025-05-19T23:13:32.169049+00:00

Arch Linux Security Advisory ASA-202505-10
==========================================

Severity: Medium
Date    : 2025-05-19
CVE-ID  : CVE-2025-32873
Package : python-django
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2876

Summary
=======

The package python-django before version 5.1.9-1 is vulnerable to
denial of service.

Resolution
==========

Upgrade to 5.1.9-1.

# pacman -Syu "python-django>=5.1.9-1"

The problem has been fixed upstream in version 5.1.9.

Workaround
==========

None.

Description
===========

django.utils.html.strip_tags() would be slow to evaluate certain inputs
containing large sequences of incomplete HTML tags. This function is
used to implement the striptags template filter, which was thus also
vulnerable. django.utils.html.strip_tags() now raises a
SuspiciousOperation exception if it encounters an unusually large
number of unclosed opening tags.

Impact
======

A remote attacker can exploit inefficient HTML tag parsing in Django’s
strip_tags() function to cause excessive CPU usage, leading to a denial
of service. This may affect applications that use the striptags
template filter to sanitize user-controlled input, making them
vulnerable to slowdown or unresponsiveness when handling specially
crafted HTML content.

References
==========

https://www.djangoproject.com/weblog/2025/may/07/security-releases/
https://security.archlinux.org/CVE-2025-32873

[ASA-202505-11] freetype2: arbitrary code execution

2025-05-19T23:22:09.165206+00:00

Arch Linux Security Advisory ASA-202505-11
==========================================

Severity: High
Date    : 2025-05-19
CVE-ID  : CVE-2025-27363
Package : freetype2
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2877

Summary
=======

The package freetype2 before version 2.13.3-3 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 2.13.3-3.

# pacman -Syu "freetype2>=2.13.3-3"

The problem has been fixed upstream in version 2.13.3.

Workaround
==========

None.

Description
===========

An out of bounds write exists in FreeType versions 2.13.0 and below
when attempting to parse font subglyph structures related to TrueType
GX and variable font files. The vulnerable code assigns a signed short
value to an unsigned long and then adds a static value causing it to
wrap around and allocate too small of a heap buffer. The code then
writes up to 6 signed long integers out of bounds relative to this
buffer. This may result in arbitrary code execution. This vulnerability
may have been exploited in the wild.

Impact
======

A remote attacker that is able to load a specially crafted font file is
able to execute arbitrary code on the affected host.

References
==========

https://www.facebook.com/security/advisories/cve-2025-27363
https://gitlab.freedesktop.org/freetype/freetype/-/commit/ef636696524b081f1b8819eb0c6a0b932d35757d
https://security.archlinux.org/CVE-2025-27363

[ASA-202505-12] go: directory traversal

2025-05-19T23:37:20.016975+00:00

Arch Linux Security Advisory ASA-202505-12
==========================================

Severity: Low
Date    : 2025-05-19
CVE-ID  : CVE-2025-22873
Package : go
Type    : directory traversal
Remote  : No
Link    : https://security.archlinux.org/AVG-2878

Summary
=======

The package go before version 2:1.24.3-1 is vulnerable to directory
traversal.

Resolution
==========

Upgrade to 2:1.24.3-1.

# pacman -Syu "go>=2:1.24.3-1"

The problem has been fixed upstream in version 1.24.3.

Workaround
==========

None.

Description
===========

It was possible to improperly access the parent directory of a
restricted filesystem root created with os.DirFS. Calling Open("../")
on such a filesystem could open the parent directory itself, violating
expected directory confinement. This escape did not allow access to
ancestor directories beyond the parent, nor to files within the parent
directory.

This behavior has been corrected to return an error for such paths.

Impact
======

A local attacker or untrusted component running within a Go application
could bypass directory confinement by accessing the parent directory of
a restricted os.DirFS root using a "../" path.

References
==========

https://github.com/golang/go/issues/73555
https://go.dev/doc/devel/release#go1.24.3
https://groups.google.com/g/golang-announce/c/UZoIkUT367A/m/5WDxKizJAQAJ?pli=1
https://security.archlinux.org/CVE-2025-22873

[ASA-202505-13] varnish: content spoofing

2025-05-20T20:33:21.725831+00:00

Arch Linux Security Advisory ASA-202505-13
==========================================

Severity: High
Date    : 2025-05-20
CVE-ID  : CVE-2025-47905
Package : varnish
Type    : content spoofing
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2879

Summary
=======

The package varnish before version 7.7.1-1 is vulnerable to content
spoofing.

Resolution
==========

Upgrade to 7.7.1-1.

# pacman -Syu "varnish>=7.7.1-1"

The problem has been fixed upstream in version 7.7.1.

Workaround
==========

None.

Description
===========

A client-side desync vulnerability can be triggered in Varnish Cache.
This vulnerability can be triggered under specific circumstances
involving malformed HTTP/1 chunked requests.

An attacker can abuse a flaw in Varnish’s handling of chunked transfer
encoding which allows certain malformed HTTP/1 requests to exploit
improper framing of the message body to smuggle additional requests.
Specifically, Varnish incorrectly permits CRLF to be skipped to delimit
chunk boundaries.

Impact
======

A remote attacker able to send specially crafted HTTP/1 chunked
requests can exploit Varnish to smuggle additional requests,
potentially leading to information disclosure and allowing incorrect or
malicious content to be cached and served to other users.

References
==========

https://varnish-cache.org/releases/rel7.7.1.html
https://varnish-cache.org/security/VSV00016.html
https://varnish-cache.org/lists/pipermail/varnish-announce/2025-May/000767.html
https://security.archlinux.org/CVE-2025-47905

[ASA-202505-14] bind: denial of service

2025-05-21T19:35:14.960171+00:00

Arch Linux Security Advisory ASA-202505-14
==========================================

Severity: High
Date    : 2025-05-21
CVE-ID  : CVE-2025-40775
Package : bind
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2881

Summary
=======

The package bind before version 9.20.9-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 9.20.9-1.

# pacman -Syu "bind>=9.20.9-1"

The problem has been fixed upstream in version 9.20.9.

Workaround
==========

None.

Description
===========

When an incoming DNS protocol message includes a Transaction Signature
(TSIG), BIND always checks it. If the TSIG contains an invalid value in
the algorithm field, BIND immediately aborts with an assertion failure.

Impact
======

A remote attacker can send a specially crafted DNS request leading to a
denial of service.

References
==========

https://kb.isc.org/docs/cve-2025-40775
https://downloads.isc.org/isc/bind9/9.20.9/doc/arm/html/notes.html#security-fixes
https://security.archlinux.org/CVE-2025-40775

[ASA-202505-15] ghostscript: information disclosure

2025-05-24T04:12:06.715254+00:00

Arch Linux Security Advisory ASA-202505-15
==========================================

Severity: Low
Date    : 2025-05-24
CVE-ID  : CVE-2025-48708
Package : ghostscript
Type    : information disclosure
Remote  : No
Link    : https://security.archlinux.org/AVG-2883

Summary
=======

The package ghostscript before version 10.05.1-2 is vulnerable to
information disclosure.

Resolution
==========

Upgrade to 10.05.1-2.

# pacman -Syu "ghostscript>=10.05.1-2"

The problem has been fixed upstream in version 10.05.1.

Workaround
==========

None.

Description
===========

gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex
Ghostscript before 10.05.1 lacks argument sanitization for the # case.
A created PDF document includes its password in cleartext.

Impact
======

A local attacker can access the password used to protect a PDF in
cleartext.

References
==========

https://bugs.ghostscript.com/show_bug.cgi?id=708446
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?h=gs10.05.1&id=5b5968c306b3e35cdeec83bb15026fd74a7334de
https://security.archlinux.org/CVE-2025-48708

[ASA-202506-1] roundcubemail: arbitrary code execution

2025-06-04T19:23:10.387539+00:00

Arch Linux Security Advisory ASA-202506-1
=========================================

Severity: Critical
Date    : 2025-06-04
CVE-ID  : CVE-2025-49113
Package : roundcubemail
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2891

Summary
=======

The package roundcubemail before version 1.6.11-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 1.6.11-1.

# pacman -Syu "roundcubemail>=1.6.11-1"

The problem has been fixed upstream in version 1.6.11.

Workaround
==========

None.

Description
===========

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote
code execution by authenticated users because the _from parameter in a
URL is not validated in program/actions/settings/upload.php, leading to
PHP Object Deserialization.

Impact
======

A remote attacker with access to an authenticated Roundcube session can
exploit a vulnerability leading to arbitrary code execution.

References
==========

https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
https://www.cve.org/CVERecord?id=CVE-2025-49113
https://www.openwall.com/lists/oss-security/2025/06/02/3
https://github.com/roundcube/roundcubemail/pull/9865
https://security.archlinux.org/CVE-2025-49113

[ASA-202506-2] curl: denial of service

2025-06-05T00:13:14.033869+00:00

Arch Linux Security Advisory ASA-202506-2
=========================================

Severity: Low
Date    : 2025-06-05
CVE-ID  : CVE-2025-5399
Package : curl
Type    : denial of service
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2895

Summary
=======

The package curl before version 8.14.1-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 8.14.1-1.

# pacman -Syu "curl>=8.14.1-1"

The problem has been fixed upstream in version 8.14.1.

Workaround
==========

None.

Description
===========

Due to a mistake in libcurl's WebSocket code, a malicious server can
send a particularly crafted packet which makes libcurl get trapped in
an endless busy-loop.

There is no other way for the application to escape or exit this loop
other than killing the thread/process. This might be used to DoS
libcurl-using application.

Impact
======

A remote attacker can send a specially crafted WebSocket frame that
triggers an infinite busy-loop in libcurl, causing the application to
hang indefinitely potentially leading to a denial of service.

References
==========

https://curl.se/docs/CVE-2025-5399.html
https://github.com/curl/curl/commit/d1145df24de8f80e6b16
https://security.archlinux.org/CVE-2025-5399

[ASA-202506-3] samba: access restriction bypass

2025-06-06T20:30:23.099674+00:00

Arch Linux Security Advisory ASA-202506-3
=========================================

Severity: Low
Date    : 2025-06-06
CVE-ID  : CVE-2025-0620
Package : samba
Type    : access restriction bypass
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2892

Summary
=======

The package samba before version 4.22.2-1 is vulnerable to access
restriction bypass.

Resolution
==========

Upgrade to 4.22.2-1.

# pacman -Syu "samba>=4.22.2-1"

The problem has been fixed upstream in version 4.22.2.

Workaround
==========

None.

Description
===========

When using Kerberos authentication with SMB, smbd doesn't pick up group
membership changes when re-authenticating an expired SMB session.

Impact
======

A remote authenticated attacker may retain unintended access to file
shares in Samba.

References
==========

https://www.samba.org/samba/security/CVE-2025-0620.html
https://bugzilla.samba.org/show_bug.cgi?id=15707
https://nvd.nist.gov/vuln/detail/CVE-2025-0620
https://security.archlinux.org/CVE-2025-0620

[ASA-202506-4] go: multiple issues

2025-06-07T02:58:28.491836+00:00

Arch Linux Security Advisory ASA-202506-4
=========================================

Severity: Medium
Date    : 2025-06-07
CVE-ID  : CVE-2025-4673 CVE-2025-22874
Package : go
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2896

Summary
=======

The package go before version 1.24.4-1 is vulnerable to multiple issues
including certificate verification bypass and information disclosure.

Resolution
==========

Upgrade to 1.24.4-1.

# pacman -Syu "go>=1.24.4-1"

The problems have been fixed upstream in version 1.24.4.

Workaround
==========

None.

Description
===========

- CVE-2025-4673 (information disclosure)

net/http: Proxy-Authorization and Proxy-Authenticate headers were not
cleared during cross-origin redirects, potentially leaking sensitive
credentials in proxy-authenticated environments.

- CVE-2025-22874 (certificate verification bypass)

crypto/x509: When VerifyOptions.KeyUsages includes ExtKeyUsageAny,
certificate policy validation is unintentionally disabled. This affects
certificate chains with policy constraints, which are uncommon but
security-relevant when used.

Impact
======

A remote attacker can exploit Go's HTTP client to leak proxy
credentials via cross-origin redirects, or bypass certificate policy
validation when ExtKeyUsageAny is used during TLS verification.

References
==========

https://github.com/golang/go/issues/73816
https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A/m/XDxq7uidAgAJ
https://go.dev/doc/devel/release#go1.24.4
https://github.com/golang/go/issues/73612
https://security.archlinux.org/CVE-2025-4673
https://security.archlinux.org/CVE-2025-22874

[ASA-202506-5] konsole: arbitrary code execution

2025-06-11T03:16:24.472828+00:00

Arch Linux Security Advisory ASA-202506-5
=========================================

Severity: High
Date    : 2025-06-11
CVE-ID  : CVE-2025-49091
Package : konsole
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2897

Summary
=======

The package konsole before version 25.04.2-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 25.04.2-1.

# pacman -Syu "konsole>=25.04.2-1"

The problem has been fixed upstream in version 25.04.2.

Workaround
==========

None.

Description
===========

Konsole supports loading URLs from the scheme handlers such as
telnet://URL. This can be executed regardless of whether the telnet
binary is available.

In this mode konsole had a path where if telnet was not available it
would fall back to using bash for the given arguments provided; which
is the URL provided. This allows an attacker to execute arbitrary code.

Browsers typically provide a prompt when a user opens an external
scheme handler which would look suspicious, requiring user interaction
to be exploitable.

Impact
======

A remote attacker can trick a user into opening a specially crafted URL
that exploits Konsole’s scheme handler fallback mechanism, leading to
arbitrary code execution.

References
==========

https://kde.org/info/security/advisory-20250609-1.txt
https://proofnet.de/publikationen/konsole_rce.html
https://nvd.nist.gov/vuln/detail/CVE-2025-49091
https://www.openwall.com/lists/oss-security/2025/06/10/5
https://invent.kde.org/utilities/konsole/-/commit/09d20dea109050b4c02fb73095f327b5642a2b75
https://security.archlinux.org/CVE-2025-49091

[ASA-202506-6] python-django: content spoofing

2025-06-12T07:48:46.608380+00:00

Arch Linux Security Advisory ASA-202506-6
=========================================

Severity: Low
Date    : 2025-06-12
CVE-ID  : CVE-2025-48432
Package : python-django
Type    : content spoofing
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2894

Summary
=======

The package python-django before version 5.1.11-1 is vulnerable to
content spoofing.

Resolution
==========

Upgrade to 5.1.11-1.

# pacman -Syu "python-django>=5.1.11-1"

The problem has been fixed upstream in version 5.1.11.

Workaround
==========

None.

Description
===========

Internal HTTP response logging used request.path directly, allowing
control characters (e.g. newlines or ANSI escape sequences) to be
written unescaped into logs. This could enable log injection or
forgery, letting attackers manipulate log appearance or structure,
especially in logs processed by external systems or viewed in
terminals.

Impact
======

A remote attacker can manipulate log entries by sending crafted HTTP
requests with control characters in the path, potentially spoofing or
injecting content into server logs.

References
==========

https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/
https://docs.djangoproject.com/en/dev/releases/5.1.10/#cve-2025-48432-potential-log-injection-via-unescaped-request-path
https://docs.djangoproject.com/en/dev/releases/5.1.11/
https://security.archlinux.org/CVE-2025-48432

[ASA-202610-1] php: arbitrary code execution

2026-10-21T16:20:39.346654+00:00

Arch Linux Security Advisory ASA-202610-1
=========================================

Severity: Critical
Date    : 2026-10-21
CVE-ID  : CVE-2026-109618 CVE-2026-109619
Package : php
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2909

Summary
=======

The package php before version 8.5.12-1 is vulnerable to arbitrary code
execution.

Resolution
==========

Upgrade to 8.5.12-1.

# pacman -Syu "php>=8.5.12-1"

The problems have been fixed upstream in version 8.5.12.

Workaround
==========

If you cannot update immediately: while only an update is a complete
solution, the following measures reduce exposure to specific attack
paths but do not make an installation safe.

RCE via OOM corruption (CVE-2026-109618):

- Set memory_limit=-1, preferably in a way applications can't override,
such as php_admin_value in the FPM pool or Apache configuration, and
check that no pool, directory or application setting puts a finite
limit back. This removes the controllable PHP memory limit failure, but
an underlying allocation failure can still reach the vulnerable path.
- Set a low post_max_size. For applications that don't require file
uploads, set post_max_size = 8M. If file uploads are necessary, set
post_max_size = 32M. Keep upload_max_filesize below post_max_size.
Consider enforcing limits at the web server or proxy level for decoded
request size, input field count, multipart part count, header count,
and nesting depth. These limits must also cover requests without a
usable Content-Length.
- Use a container or cgroup limit as an availability boundary,
preferably with a policy that kills only the affected worker. Do not
substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable
allocation failure.

RCE via stale global state (CVE-2026-109619):

- Set session.upload_progress.enabled=0 and restart every worker. Use
php.ini, an FPM pool or server configuration that applies before
request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks
the confirmed session paths but not other variants.
- On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
This blocks the confirmed fatal backtrace path only.
- Remove invalid or deprecated settings applied per request that emit
diagnostics before initialization. Hiding diagnostics with
error_reporting, display_errors or @ does not help.
- Fix attacker-reachable fatal errors and execution timeouts, including
failures in callbacks, upload or import processing and cleanup.

Description
===========

- CVE-2026-109618 (arbitrary code execution)

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current
context and abort handling of the request. In some contexts, request
memory is temporarily reachable before it is fully initialized. If any
allocation fails at that point, PHP does not properly account for the
early exit and leaves the request memory in an invalid state. The
failed allocation does not need to be related to the invalid memory.
The request shutdown procedure may then read or branch on it. Multiple
OOM strategies can consistently trigger this condition and lead to
remote code execution (RCE).

- CVE-2026-109619 (arbitrary code execution)

PHP contains various global state, such as error, session, object and
extension state that is retained by a worker but points to memory owned
by one request. That state must be reset before the request memory is
released. Some input, configuration, session and error handling
operations run before normal initialization of the next request. They
inadvertently access stale state not reset by the previous request
before initialization has a chance to replace it, causing a use after
free. A strategically crafted heap layout can produce full remote code
execution (RCE).

Impact
======

A remote unauthenticated attacker can execute arbitrary code on the
affected host with the privileges of the PHP worker by sending
specially crafted HTTP requests.

References
==========

https://www.php.net/archive/2026.php#2026-10-21-4
https://www.php.net/archive/2026.php#2026-10-21-5
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://security.archlinux.org/CVE-2026-109618
https://security.archlinux.org/CVE-2026-109619

[ASA-202610-2] php-legacy: arbitrary code execution

2026-10-21T16:25:13.623503+00:00

Arch Linux Security Advisory ASA-202610-2
=========================================

Severity: Critical
Date    : 2026-10-21
CVE-ID  : CVE-2026-109618 CVE-2026-109619
Package : php-legacy
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2910

Summary
=======

The package php-legacy before version 8.3.36-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 8.3.36-1.

# pacman -Syu "php-legacy>=8.3.36-1"

The problems have been fixed upstream in version 8.3.36.

Workaround
==========

If you cannot update immediately: while only an update is a complete
solution, the following measures reduce exposure to specific attack
paths but do not make an installation safe.

RCE via OOM corruption (CVE-2026-109618):

- Set memory_limit=-1, preferably in a way applications can't override,
such as php_admin_value in the FPM pool or Apache configuration, and
check that no pool, directory or application setting puts a finite
limit back. This removes the controllable PHP memory limit failure, but
an underlying allocation failure can still reach the vulnerable path.
- Set a low post_max_size. For applications that don't require file
uploads, set post_max_size = 8M. If file uploads are necessary, set
post_max_size = 32M. Keep upload_max_filesize below post_max_size.
Consider enforcing limits at the web server or proxy level for decoded
request size, input field count, multipart part count, header count,
and nesting depth. These limits must also cover requests without a
usable Content-Length.
- Use a container or cgroup limit as an availability boundary,
preferably with a policy that kills only the affected worker. Do not
substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable
allocation failure.

RCE via stale global state (CVE-2026-109619):

- Set session.upload_progress.enabled=0 and restart every worker. Use
php.ini, an FPM pool or server configuration that applies before
request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks
the confirmed session paths but not other variants.
- On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
This blocks the confirmed fatal backtrace path only.
- Remove invalid or deprecated settings applied per request that emit
diagnostics before initialization. Hiding diagnostics with
error_reporting, display_errors or @ does not help.
- Fix attacker-reachable fatal errors and execution timeouts, including
failures in callbacks, upload or import processing and cleanup.

Description
===========

- CVE-2026-109618 (arbitrary code execution)

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current
context and abort handling of the request. In some contexts, request
memory is temporarily reachable before it is fully initialized. If any
allocation fails at that point, PHP does not properly account for the
early exit and leaves the request memory in an invalid state. The
failed allocation does not need to be related to the invalid memory.
The request shutdown procedure may then read or branch on it. Multiple
OOM strategies can consistently trigger this condition and lead to
remote code execution (RCE).

- CVE-2026-109619 (arbitrary code execution)

PHP contains various global state, such as error, session, object and
extension state that is retained by a worker but points to memory owned
by one request. That state must be reset before the request memory is
released. Some input, configuration, session and error handling
operations run before normal initialization of the next request. They
inadvertently access stale state not reset by the previous request
before initialization has a chance to replace it, causing a use after
free. A strategically crafted heap layout can produce full remote code
execution (RCE).

Impact
======

A remote unauthenticated attacker can execute arbitrary code on the
affected host with the privileges of the PHP worker by sending
specially crafted HTTP requests.

References
==========

https://www.php.net/archive/2026.php#2026-10-21-4
https://www.php.net/archive/2026.php#2026-10-21-5
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
https://security.archlinux.org/CVE-2026-109618
https://security.archlinux.org/CVE-2026-109619