CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)

Key Points:

• CVE-2026-109618 is a pointer underflow vulnerability in PHP's CGI SAPI that allows unauthenticated remote code execution.
• The vulnerability affects all PHP versions from 5.x to 8.4.26 with the default configuration (cgi.fix_pathinfo=1), exposing approximately 884,000 internet-facing hosts.
• Recommended mitigation includes setting cgi.fix_pathinfo=0 in the php.ini configuration file.

Technical Details: The vulnerability arises from a missing bounds check in path_info pointer arithmetic within the CGI SAPI, allowing attackers to exploit it through an out-of-bounds read and subsequent code execution via .user.ini file injection.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned