PHP: remote code execution through memory corruption when a request runs out of memory
PHP-CVE-2026-109618 · CVE-2026-109618
Our decision for FreeSense
The PHP project fixed this in PHP 8.5.12. FreeSense Stable ships PHP 8.5.12 since 1.1.10 (current release 1.1.11). Development 1.2 has PHP 8.5.12 on its main branch and ships it with its next nightly build. FreeSense 1.0 is frozen and still ships an affected PHP 8.5; it will not get a fix.
- PHP 8.5.12 NEWS lists CVE-2026-109618 and CVE-2026-109619
- freesense-system-ports lang/php85 overlay: PHP 8.5.12 (RELENG_1_1 1ac72ce, main ed03940)
- Release notes: https://docs.freesense.org/releases/1.1.10/ and https://docs.freesense.org/releases/1.1.11/
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | OpenFrozen, no fix. Upgrade to 1.1 (1.1.11) | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | Fixed1.1.10 (current: 1.1.11) | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | OpenNext Development nightly build (PHP 8.5.12 is on main) | 2026-10-04a52c50b4 |
Workaround
Update FreeSense 1.1 to the current Stable release (1.1.11; 1.1.10 already carries the fix). Until then, do not expose the WebUI to untrusted networks. On FreeSense 1.0 no fix will be released: upgrade to 1.1 (the upgrade is one-way, see the 1.0 upgrade guide) and keep the WebUI off untrusted networks until you do. Development 1.2 systems run the affected PHP until the next nightly build; keep their WebUI off untrusted networks.
What PHP says
PHP leaves a request in an invalid state when it runs out of memory early, for example while parsing a crafted multipart upload, and request shutdown then uses that memory. The PHP project rates it critical (CVSS 4.0 score 9.2) and says it can allow remote code execution without logging in. The exploit it demonstrates is against Apache mod_php; it says PHP-FPM, which the FreeSense WebUI uses, looks susceptible from source analysis, but no complete exploit has been shown.
Impact
Remote code execution in the PHP process that serves the WebUI, without authentication.
Summary of the PHP advisory. Read the original for the full text and the fix.