PHP2Shell(CVE-2026-109618 / CVE-2026-109619)——自编译 / 源码层方案

本文针对PHP中由OOM触发的严重漏洞CVE-2026-109618与CVE-2026-109619,提出基于源码编译的二进制层修复方案。核心在于移植官方UnwindExit机制(8.x完整根治)或最小缓解补丁(7.x/5.x),覆盖PHP 5.5–8.5全版本。方案规避运行期开关风险,强调SRPM重打包、worker复用拦截、zval/EG状态复位及efree后置NULL等关键技术点,并提供非攻击式验证方法。

适用场景:从二进制层关门,把官方补丁编进 PHP,而不是靠可被覆盖的运行期开关。
核心事实(已对 php-src 核实):

  • 完整根治补丁 = commit 3584a98bda0「Replace bailout on OOM with UnwindExit; properly reset various globals」,已发版 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12。
  • 7.x 与 ≤8.1 没有官方发版 tag,官方只给了一个 EOL 源码分支 PHP-8.0-CVE-2026-109618-109619(commit 82f8f31b16a,最小化缓解版,非完整根治)。

1. 根因与两种修法的区别

致命错误(OOM)时 PHP 调 zend_bailout() 做 longjmp,native 清理被打断,残留的半初始化/已释放状态被后续请求或复用 worker 读到。

官方给了两档修法,这决定了不同版本能做到哪一步:

档位commit做了什么能否移植到老引擎
完整根治3584a98bda0用 UnwindExit 替换 OOM 时的 bailout,让异常路径走正常栈回退;并在 startup 前正确复位各全局(EG/PG/SAPI)。附带大量 oom_*.phpt 回归测试仅 Zend Engine 4(PHP 8)原生;引擎差异大,不能机械 cherry-pick 到 7.x/5.x
最小缓解(EOL)82f8f31b16a① ext/session/session.c:if (!PS(rfc1867_enabled) || true) 永久关 upload_progress 回调;② main/SAPI.c:efree 后把 auth_*/content_type_dup/current_user 置 NULL;③ main/main.c、Zend/zend_execute_API.c:复位 http_globals / EG 若干字段①② 思路可移植;③ 需按各引擎改写

要点:完整根治改的是 Zend 引擎的 bailout 机制,这套只对 PHP 8 的引擎成立。越老的分支,越只能退回"最小缓解"这一档。


2. PHP 8.x(8.2 / 8.3 / 8.4 / 8.5)——直接编官方修复版

最省事,也最彻底:拉已含 3584a98bda0 的发版 tag,原样编译。

# 以 8.3.36 为例;其余换成 8.2.35 / 8.4.27 / 8.5.12
curl -fsSLO https://www.php.net/distributions/php-8.3.36.tar.gz
tar xf php-8.3.36.tar.gz && cd php-8.3.36

# 关键:沿用你现网二进制的 configure 参数,避免编出来缺扩展
#   现网机器上执行 `php -i | grep 'Configure Command'` 拿到原始参数,原样贴到下面
./configure $(php -i | sed -n 's/^Configure Command => //p' | tr -d "'")
make -j"$(nproc)"
make test        # 应能看到 oom_*.phpt 这批回归用例通过 = 根治补丁在起作用
sudo make install

8.0 / 8.1(无发版 tag):把 EOL 分支 PHP-8.0-CVE-2026-109618-109619 的差异 git format-patch 出来,应用到对应 8.0/8.1 源码再编(它们引擎同代,最小缓解可用,但拿不到 UnwindExit 的完整根治)。


3. PHP 7.x(7.0–7.4)——移植最小缓解后自编译

无官方任何发版。7.x 是 Zend Engine 3,比 5.x 接近 8.0,EG/PG 复位那部分比 5.x 好移植,但 UnwindExit 那套仍不适用。可落地的是最小缓解三件套:

/* ext/session/session.c —— php_session_rfc1867_callback 内,核心一行 */
-   if (!PS(rfc1867_enabled)) {
+   if (!PS(rfc1867_enabled) || 1) {  /* CVE-2026-109618: 永久关 upload_progress 回调 */
        return retval;
    }
/* main/SAPI.c —— sapi_deactivate 内,每个 efree 后补一行置 NULL,防 bailout 后二次释放 */
    if (SG(request_info).auth_user)       { efree(SG(request_info).auth_user);       SG(request_info).auth_user = NULL; }
    if (SG(request_info).auth_password)   { efree(SG(request_info).auth_password);   SG(request_info).auth_password = NULL; }
    if (SG(request_info).content_type_dup){ efree(SG(request_info).content_type_dup);SG(request_info).content_type_dup = NULL; }
    /* auth_digest / current_user 同理 */

第三件(main/main.c 请求关闭时复位 http_globals、Zend/zend_execute_API.c 复位 EG 字段)——7.x 要按本分支的 zval/EG 定义改写(7.x 用 ZVAL_UNDEF 的方式与 8.0 接近,可对照 82f8f31b16a 逐行翻译)。

编译流程同第 2 节(换 7.x 源码 + 现网 configure 参数)。叠加运行期 pm.max_requests=1 兜住 109619 的 worker 复用面。


4. PHP 5.x(5.5 / 5.6)——本项目线上,只能做到最小缓解

诚实结论:5.x 是 Zend Engine 2.6,zval 结构、分配器、VM 与 PHP 8 完全不同,UnwindExit 的完整根治无法移植,也没有任何上游参照。能干净落地的只有:

  1. ext/session/session.c 的 || 1(同第 3 节那行)——这正是官方给 EOL 用的同一招,直接堵死 109618 的主泄露路径,且因为编进了二进制,比 ini 的 enabled=0 更硬(改不掉、不能被逐请求覆盖)。
  2. main/SAPI.c 的 efree 后置 NULL——5.x 的 SAPI.c 结构一致,可照搬,防 SAPI 请求信息指针的 UAF/二次释放。
  3. 运行期 pm.max_requests=1 打断 worker 复用,压 109619。

残余风险:以上组合关死了 109618 的已知利用面,并大幅收窄 109619,但不等于像 8.x 那样的引擎级根治。5.x 的最终出路仍是升级框架 + PHP,这篇只是把"不能升级的这段时间"的风险降到工程上可接受。

本项目的落地路径(remi SCL,不是官方 tarball)

线上用的是 /opt/remi/php56、/opt/remi/php55,不能直接 make install 覆盖,要走 SRPM 重打包,否则会和 yum 管理冲突:

# 在一次性构建容器里做,绝不在生产机编译(红线:实验不碰真实资产)
# 1. 装对应 SRPM(版本要和现网完全一致:php 5.6.37 / 5.5.30)
rpmbuild --rebuild php56-php-*.src.rpm          # 先解包拿到 SPEC + 源码 tarball
# 2. 把上面 ①② 的改动做成 patch,塞进 SPEC 的 PatchNNN + %patchNNN
# 3. 重新 rpmbuild -ba SPECS/php56.spec,产出带补丁的 php56-php-* 子包
# 4. 灰度:先在一台(如当前没对外的机器)yum localinstall,验证后再滚动

替换 RPM = 停服级变更。按红线:先在隔离容器编译验证,线上替换和重启须逐台确认。


5. 编译后怎么验证"补丁真的生效"(良性,不碰攻击)

用 upload_progress 这个文档化功能本身反证回调已被关闭,不触发 OOM、不做内存回显、不打 shell:

; probe.ini
session.upload_progress.enabled=1
session.upload_progress.cleanup=0
session.save_path=/tmp
// target.php:上传完成后读 session,看回调有没有写入
<?php session_start();
$hit = array_filter(array_keys($_SESSION), function($k){ return strpos($k,'upload_progress_')===0; });
echo 'upload_progress_keys=' . ($hit ? implode(',',$hit) : 'NONE') . "\n";

对同一个带 PHP_SESSION_UPLOAD_PROGRESS 字段的 multipart 上传:

  • 未打补丁:输出 upload_progress_...(回调是活的)
  • 打补丁后:输出 NONE(回调已被编译期关闭)→ 证明 109618 路径已关。

参考

  • 完整根治 commit 3584a98bda0;EOL 最小缓解分支 PHP-8.0-CVE-2026-109618-109619 / commit 82f8f31b16a
  • 已发版:php-8.2.35 / 8.3.36 / 8.4.27 / 8.5.12(7.x、8.0、8.1 无发版 tag)
  • GHSA-w8hw-w9fx-j79w(CVE-2026-109618)/ GHSA-6wmf-4rv5-p3rp(CVE-2026-109619)
深度学习工具包Deprecation notice.-----This toolbox is outdated and no longer maintained.There are much better tools available for deep learning than this toolbox, e.g. [Theano](http://deeplearning.net/software/theano/), [torch](http://torch.ch/) or [tensorflow](http://www.tensorflow.org/)I would suggest you use one of the tools mentioned above rather than use this toolbox.Best, Rasmus.DeepLearnToolbox================A Matlab toolbox for Deep Learning.Deep Learning is a new subfield of machine learning that focuses on learning deep hierarchical models of data.It is inspired by the human brain's apparent deep (layered, hierarchical) architecture.A good overview of the theory of Deep Learning theory is[Learning Deep Architectures for AI](http://www.iro.umontreal.ca/~bengioy/papers/ftml_book.pdf)For a more informal introduction, see the following videos by Geoffrey Hinton and Andrew Ng.* [The Next Generation of Neural Networks](http://www.youtube.com/watch?v=AyzOUbkUf3M) (Hinton, 2007)* [Recent Developments in Deep Learning](http://www.youtube.com/watch?v=VdIURAu1-aU) (Hinton, 2010)* [Unsupervised Feature Learning and Deep Learning](http://www.youtube.com/watch?v=ZmNOAtZIgIk) (Ng, 2011)If you use this toolbox in your research please cite [Prediction as a candidate for learning deep hierarchical models of data](http://www2.imm.dtu.dk/pubdb/views/publication_details.php?id=6284)```@MASTERSTHESIS\{IMM2012-06284, author = "R. B. Palm", title = "Prediction as a candidate for learning deep hierarchical models of data", year = "2012",}```Contact: rasmusbergpalm at gmail dot comDirectories included in the toolbox-----------------------------------`NN/` - A library for Feedforward Backpropagation Neural Networks`CNN/` - A library for Convolutional Neural Networks`DBN/` - A library for Deep Belief Networks`SAE/` - A library for Stacked Auto-Encoders`CAE/` - A library for Convolutional Auto-Encoders`util/` - Utility functions used by the libraries`data/` - Data used by the examples`tests/` - unit tests to verify toolbox is workingFor references on each library check REFS.mdSetup-----1. Download.2. addpath(genpath('DeepLearnToolbox'));Example: Deep Belief Network---------------------```matlabfunction test_example_DBNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit RBM and visualize its weightsrand('state',0)dbn.sizes = [100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);figure; visualize(dbn.rbm{1}.W'); % Visualize the RBM weights%% ex2 train a 100-100 hidden unit DBN and use its weights to initialize a NNrand('state',0)%train dbndbn.sizes = [100 100];opts.numepochs = 1;opts.batchsize = 100;opts.momentum = 0;opts.alpha = 1;dbn = dbnsetup(dbn, train_x, opts);dbn = dbntrain(dbn, train_x, opts);%unfold dbn to nnnn = dbnunfoldtonn(dbn, 10);nn.activation_function = 'sigm';%train nnopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.10, 'Too big error');```Example: Stacked Auto-Encoders---------------------```matlabfunction test_example_SAEload mnist_uint8;train_x = double(train_x)/255;test_x = double(test_x)/255;train_y = double(train_y);test_y = double(test_y);%% ex1 train a 100 hidden unit SDAE and use it to initialize a FFNN% Setup and train a stacked denoising autoencoder (SDAE)rand('state',0)sae = saesetup([784 100]);sae.ae{1}.activation_function = 'sigm';sae.ae{1}.learningRate = 1;sae.ae{1}.inputZeroMaskedFraction = 0.5;opts.numepochs = 1;opts.batchsize = 100;sae = saetrain(sae, train_x, opts);visualize(sae.ae{1}.W{1}(:,2:end)')% Use the SDAE to initialize a FFNNnn = nnsetup([784 100 10]);nn.activation_function = 'sigm';nn.learningRate = 1;nn.W{1} = sae.ae{1}.W{1};% Train the FFNNopts.numepochs = 1;opts.batchsize = 100;nn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.16, 'Too big error');```Example: Convolutional Neural Nets---------------------```matlabfunction test_example_CNNload mnist_uint8;train_x = double(reshape(train_x',28,28,60000))/255;test_x = double(reshape(test_x',28,28,10000))/255;train_y = double(train_y');test_y = double(test_y');%% ex1 Train a 6c-2s-12c-2s Convolutional neural network %will run 1 epoch in about 200 second and get around 11% error. %With 100 epochs you'll get around 1.2% errorrand('state',0)cnn.layers = { struct('type', 'i') %input layer struct('type', 'c', 'outputmaps', 6, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %sub sampling layer struct('type', 'c', 'outputmaps', 12, 'kernelsize', 5) %convolution layer struct('type', 's', 'scale', 2) %subsampling layer};cnn = cnnsetup(cnn, train_x, train_y);opts.alpha = 1;opts.batchsize = 50;opts.numepochs = 1;cnn = cnntrain(cnn, train_x, train_y, opts);[er, bad] = cnntest(cnn, test_x, test_y);%plot mean squared errorfigure; plot(cnn.rL);assert(er<0.12, 'Too big error');```Example: Neural Networks---------------------```matlabfunction test_example_NNload mnist_uint8;train_x = double(train_x) / 255;test_x = double(test_x) / 255;train_y = double(train_y);test_y = double(test_y);% normalize[train_x, mu, sigma] = zscore(train_x);test_x = normalize(test_x, mu, sigma);%% ex1 vanilla neural netrand('state',0)nn = nnsetup([784 100 10]);opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samples[nn, L] = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.08, 'Too big error');%% ex2 neural net with L2 weight decayrand('state',0)nn = nnsetup([784 100 10]);nn.weightPenaltyL2 = 1e-4; % L2 weight decayopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex3 neural net with dropoutrand('state',0)nn = nnsetup([784 100 10]);nn.dropoutFraction = 0.5; % Dropout fraction opts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex4 neural net with sigmoid activation functionrand('state',0)nn = nnsetup([784 100 10]);nn.activation_function = 'sigm'; % Sigmoid activation functionnn.learningRate = 1; % Sigm require a lower learning rateopts.numepochs = 1; % Number of full sweeps through dataopts.batchsize = 100; % Take a mean gradient step over this many samplesnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex5 plotting functionalityrand('state',0)nn = nnsetup([784 20 10]);opts.numepochs = 5; % Number of full sweeps through datann.output = 'softmax'; % use softmax outputopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, train_x, train_y, opts);[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');%% ex6 neural net with sigmoid activation and plotting of validation and training error% split training data into training and validation datavx = train_x(1:10000,:);tx = train_x(10001:end,:);vy = train_y(1:10000,:);ty = train_y(10001:end,:);rand('state',0)nn = nnsetup([784 20 10]); nn.output = 'softmax'; % use softmax outputopts.numepochs = 5; % Number of full sweeps through dataopts.batchsize = 1000; % Take a mean gradient step over this many samplesopts.plot = 1; % enable plottingnn = nntrain(nn, tx, ty, opts, vx, vy); % nntrain takes validation set as last two arguments (optionally)[er, bad] = nntest(nn, test_x, test_y);assert(er < 0.1, 'Too big error');```[![Bitdeli Badge](https://d2weczhvl823v0.cloudfront.net/rasmusbergpalm/deeplearntoolbox/trend.png)](https://bitdeli.com/free "Bitdeli Badge")
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付:10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值