Php Zero Days Cve 2026 109618

I got my first message about these new PHP zero-day vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ) at 4:30am Eastern, but didn’t see it until 7:50am. By then there were many more messages I hadn’t read yet, so I started working on detection content right away. Within 4 hours I had detection solutions posted.

With new PHP zero days out, the first question is usually: where is PHP installed, and which versions? Package managers only answer part of that. One-off installs like XAMPP, MAMP, Laragon, a zip unpacked to C:\php, or a static build such as FrankenPHP don’t show up there.

I wrote YARA rules and small scan scripts that find PHP installs on Windows, macOS and Linux and report the exact version of each, without running PHP.

The rules and scripts are here: https://github.com/jgstew/tools/tree/master/YARA/php

How it works:

PHP builds contain their version as a string compiled into the binary (X-Powered-By: PHP/8.4.26), even with expose_php turned off. On Windows, every php.exe, DLL and extension also has the version in its file properties. The YARA rules match those, so the version comes from the file itself, including distro builds like 8.1.2-1ubuntu2.27.

Each script is self-contained:

downloads a pinned release of the YARA-X CLI and checks its SHA256
scans the whole local disk (or a path you give it) with the embedded rules
skips things that can’t hold a PHP install, to keep it fast: network shares, files of 512 MB or more, images/media/documents, and on macOS the read-only system volume
writes a simple results file with one path<TAB>version line per file found, plus the raw YARA output and a log

The rules are deliberately broad: it’s better to flag something PHP-related that turns out to be uninteresting than to miss an install. PHP extensions on Linux and macOS report as unknown, since they don’t carry the full version.

Usage:

macOS or Linux, run as root for a full scan:

sudo bash yara_x_scan_macos.sh
sudo bash yara_x_scan_linux.sh

Windows, run as Administrator:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\yara_x_scan_windows.ps1

Or scan just one folder:

sudo bash yara_x_scan_linux.sh -t /opt

Results go to ./yara_results, for example:

/usr/bin/php8.3	8.3.6
/usr/lib/php/20230831/opcache.so	unknown
C:\php\php8ts.dll	8.5.11

The YARA rules can also be used on their own with yara or yr, or in other tools that support YARA rules. See the README for details.

BigFix content that runs these scans and reports the results is available here: https://github.com/bigfix/Site_Rapid_Response

More info: https://forum.bigfix.com/t/zero-day-php-cve-2026-109618-and-cve-2026-109619/56122/3