PHP: remote code execution through state left over from a previous request
PHP-CVE-2026-109619 · CVE-2026-109619
Our decision for FreeSense
The PHP project fixed this in PHP 8.5.12. FreeSense Stable ships PHP 8.5.12 since 1.1.10 (current release 1.1.11). Development 1.2 has PHP 8.5.12 on its main branch and ships it with its next nightly build. FreeSense 1.0 is frozen and still ships an affected PHP 8.5; it will not get a fix.
- PHP 8.5.12 NEWS lists CVE-2026-109618 and CVE-2026-109619
- freesense-system-ports lang/php85 overlay: PHP 8.5.12 (RELENG_1_1 1ac72ce, main ed03940)
- Release notes: https://docs.freesense.org/releases/1.1.10/ and https://docs.freesense.org/releases/1.1.11/
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | OpenFrozen, no fix. Upgrade to 1.1 (1.1.11) | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | Fixed1.1.10 (current: 1.1.11) | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | OpenNext Development nightly build (PHP 8.5.12 is on main) | 2026-10-04a52c50b4 |
Workaround
Update FreeSense 1.1 to the current Stable release (1.1.11; 1.1.10 already carries the fix). Until then, do not expose the WebUI to untrusted networks. On FreeSense 1.0 no fix will be released: upgrade to 1.1 (the upgrade is one-way, see the 1.0 upgrade guide) and keep the WebUI off untrusted networks until you do. Development 1.2 systems run the affected PHP until the next nightly build; keep their WebUI off untrusted networks.
What PHP says
PHP can keep state that points into memory owned by a finished request, and a later request on the same worker can use it before it is replaced. The PHP project rates it critical (CVSS 4.0 score 9.2) and says it can lead to a use-after-free and remote code execution without logging in. It confirms exploits for two cases, fatal error backtraces (on by default in PHP 8.5) and session upload progress, against mod_php and, for the second, PHP-FPM with specific frontend settings.
Impact
Remote code execution in the PHP process that serves the WebUI, without authentication.
Summary of the PHP advisory. Read the original for the full text and the fix.