PHP-FPM

Two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been identified in the PHP core, allowing unauthenticated attackers to execute code via multipart form manipulation. The flaws are being actively exploited by automated scanning tools following a leak of proof-of-concept material.

A long-standing bug in PHP-FPM's FastCGI client authorization logic allowed a massive range of IPv6 addresses to bypass access controls. The issue stemmed from a hardcoded 12-byte comparison that failed to validate the full 128-bit IPv6 address.

This article details the dynamic analysis of the RedTail Linux malware, focusing on its ability to masquerade as legitimate system processes. The researcher demonstrates how the malware attempts to evade detection by killing monitoring tools and using DNS-over-TLS for network activity.