api.permutive.app
2
Checks recorded
2026-10-22 05:19:14
First seen (UTC)
2026-10-22 06:07:48
Last seen (UTC)
—
Evidence source
Coverage
CVE-2026-109618
CVSS 9.2
Out-of-memory corruption
Memory exhaustion corrupts PHP-core state, enabling unauthenticated remote code execution on the target server.
CVE-2026-109619
CVSS 9.2
Stale global state across requests
Request state persists across PHP worker reuse, leaking sensitive memory (credentials, tokens, keys) and enabling code execution.
Remediation guidance
| Action | Detail |
|---|---|
| Upgrade PHP | Move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later). Only a full upgrade removes the vulnerability. |
| Restart PHP services | Restart Apache / PHP-FPM / long-running workers after the upgrade so no stale workers remain. |
| memory_limit = -1 | Avoids the vulnerable OOM code path; contain usage with cgroup memory.max instead. |
| Reduce memory pressure | Lower post_max_size and max_input_nesting_level; disable session.upload_progress. |
| display_errors = 0 | Hides error output, reducing memory-disclosure surface. |
| fatal_error_backtraces = 0 | Blocks one demonstrated trigger mechanism where the setting is supported. |
| Lower pm.max_requests | Recycles PHP-FPM workers more often, limiting stale state across requests. |
| SELinux / AppArmor | Constrain worker capabilities to limit the impact of a successful exploit. |
Temporary mitigations reduce exposure only — upgrading PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later) is the complete fix. Reference: php2shell.com.
Check history
| Verdict | PHP | Evidence source | Input | Checked at (UTC) |
|---|---|---|---|---|
| not php | — | — | recheck | 2026-10-22 06:07:48 |
| not php | — | — | nextdns | 2026-10-22 05:19:14 |