DEV Community

禾
禾

Posted on

How PHP-FPM Worker State Can Carry Risk Between Requests

#php #cve #waf #checklist

CVE-2026-109619 is a worker problem. PHP-FPM keeps processes alive so the next request is cheap. That reuse is also the risk: the advisory says abnormal global state can survive from one request into the next and create a memory-safety issue.

Login and session code are the obvious places this shows up, because they already depend on state that is supposed to be per request. File upload sits beside them. A pool that has been up for weeks is not "stable" in this context. It is a process that has had more chances to carry residue.

This is still PHP Core. Replacing a plugin does not reset worker globals. You have to know which pool serves which site, restart that pool after the upgrade, and watch whether the error log grows after the restart.

SafeLine's dedicated rule, published 21 October 2026, is aimed at the HTTP signs of the known chain, especially risky multipart/form-data uploads. It will not prove that a worker leaked state. It will show you which clients are sending the request pattern associated with the chain, including PHP_SESSION_UPLOAD_PROGRESS, a characteristic PHPSESSID, and odd form fields. The note is here: PHP Core rule.

Use observe mode so those hits land in the attack log with time, source address, site, and path. Pair that log with the PHP-FPM error log for the same minute. If the worker fault and the request line up, you have a case. If only the worker fault appears, keep looking at version and pool config before you blame the WAF rule.

After a confirmed hit, widen the check: new or changed PHP files, odd processes, unexpected outbound connections, unknown cron jobs, and whether admin, database, or API credentials should be rotated.

Does a PHP-FPM reload clear the issue?

A reload drops old workers, but only a patched binary keeps the next workers safe.

Should session stores be wiped?

Not by default. Rotate credentials if you already see compromise, not because the advisory exists.

Is this the same bug as the upload parser issue?

No. CVE-2026-109618 is the multipart parser. CVE-2026-109619 is worker global state.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)