Sources an duba su tun daga Oktoba 22, 2026. Masu sauraro: PHP masu aiki da aikace-aikacen, masu amsa tsaro, da injiniyoyi masu kiyaye al’ada PHP suna ginawa.

Wannan labarin yana taƙaita sanadi, girman tasiri, tsarin gyara na yau da kullun, matakan ragewa na ɗan lokaci da aiwatar da facin hukuma na raunin PHP2Shell. An kawo babban rubutu ta amfani da lambobi kamar S1; Ana jera duk hanyoyin haɗin yanar gizo a cikin shafi a ƙarshen rubutun. Guntuwar daidaitawa samfuri ne na turawa, wanda ke buƙatar daidaitawa dangane da ainihin sigar, ƙarfin kasuwanci, da daidaitawar gadon gado.

TL;DR: Gyara matakai da shawarwari

  1. Haɓaka da PHP lokacin gudu : haɓaka reshen da ya dace zuwa aƙalla 8.2.35 , 8.3.36 , 8.4.27 ko 8.5.12 . Don fakitin rarrabawa, yi amfani da cikakkiyar sigar fakitin da mai siyarwa ya tabbatar yana gyara CVEs biyu. S1 S10
  2. Maye gurbin duk tsofaffin matakai: sake farawa ko mirgine kowane PHP worker, sabis na baƙi, da akwati bayan haɓakawa, kuma tabbatar da cewa tsoffin al’amuran sun fita.
  3. Tabbatar ta ainihin hanyar buƙatun Web: duba Web SAPI, cikakken sigar fakiti, da misali mai gudana. Duba php -v kadai baya tabbatar da cewa an gyara sabis ɗin kai tsaye.
  4. Run ya duba koma bayan kasuwanci da maido da kasafin albarkatu na yau da kullun: shiga gwaji, sarrafa zaman, lodawa, shigo da kaya, da sarrafa kuskure. Idan an cire iyakar žwažwalwar ajiya na PHP na wani dan lokaci, mayar da iyakataccen kasafin kuɗi da ya dace bayan faci.
  5. Idan haɓakawa nan da nan ba zai yiwu ba: taƙaita zirga-zirga marasa aminci kafin ya kai PHP. Ƙimar ƙaddamar da ci gaba da aikawa da kuma PHP 8.5 m backtraces kamar yadda aka bayyana a cikin Sashe na 5. Ƙimar daidaitawa da dokokin WAF suna da iyakataccen ɗaukar hoto kuma ba za su iya maye gurbin haɓakawa ba. S1S2S3

1. Bayanin Rauni da Hukunce-hukuncen Hatsari

PHP2Shell a cikin wannan labarin yana nufin biyu Critical matakin rauni vulnerabilities bisa hukuma bayyana ta PHP on Oktoba 21, 2026. Dukansu suna da alaka da ƙwaƙwalwar ajiya da kuma bukatar lifecycle management na PHP engine, haifar da hadarin m code fita. S1S2S3

AikinCVE-2026-109618CVE-2026-109619
sunan hukumaRCE via OOM corruptionRCE via stale global state
al’amurra masu mahimmanciRashin isasshen ƙwaƙwalwar ajiya yana haifar da tsalle mara kyau, yana barin yanayin da ba a gama farawa ba tukuna.Ƙasar duniya da ta rage a cikin ma’aikata tana nuna ƙwaƙwalwar buƙatar da aka saki.
Yawancin lokacin faruwaFarawa, aiwatarwa ko tsarin tsabtace buƙatun na yanzuBuƙatun da ta gabata ta bar matsayin, kuma buƙatun na gaba suna cinye shi a gaba.
Shin OOM ya zama dole?Ya kasance na ainihin hanyar haifar da rauniA’a; wasu kurakurai masu kisa da tsaftacewa bayan ganewar asali na iya shiga ciki
Mahimmin jagorar gyarawaAmincewa da Rarraba Rarrabawa da Ƙarshen NemanGyara ikon mallakar jihar, lokacin tsaftacewa da farkon farawa
Bukatun zubarwadole ne a gyaradole ne a gyara a lokaci guda

Tushen: Bayanan tsaro na hukuma guda biyu da gyara abubuwan da aka gabatar. S2S3S4

1.1 Fahimtar tura abubuwan da abin ya shafa

PHP bisa hukuma yayi la’akari duka PHP turawa handling Web buƙatun cikin hadari, gami da PHP-FPM , Apache mod_php , php-cgi , FrankenPHP , kuma LiteSpeed . An nuna mod_php harin na iya faruwa kafin lambar aikace-aikacen ta gudana, don haka bincikar shiga, tsarin tsakiya, da ingancin shigar da aikace-aikacen ba za su iya rufe wannan hanyar ba. S1

Wajibi ne a bambanta tsakanin “aikin yana buƙatar gyarawa” da “an tabbatar da wani sarkar harin gaba ɗaya”. Sanarwa na CVE-2026-109618: FPM zai fita daga tsarin yaro bayan ƙaddamar da buƙatun ya kasa, yana toshe hanyar tsaftacewa daidai da mod_php bayan gazawar farawa; duk da haka, hanyar OOM bayan nasarar farawa har yanzu yana cikin haɗari. Sanarwar ta kuma lura cewa cikakken amfani da FPM don wannan CVE ba a nuna ba tukuna. Ba za a iya amfani da wannan ƙuntatawa don ɗauka cewa FPM ba shi da lafiya, musamman CVE-2026-109619 ba za a iya watsi da shi ba. S2S3

Iyakokin izini nan da nan don cin nasarar cin nasara sun dogara da asalin tsarin da ke ɗaukar nauyin PHP da albarkatun da yake da damar zuwa. Gabaɗaya, ya kamata a ba da hankali ga lambar gidan yanar gizon, kundin adireshi, bayanan bayanan bayanai, alamun sabis da damar shiga cibiyar sadarwa na ciki; “Kisa lambar nesa” baya nufin samun izini na tushen asali. Sakamakon hukuncin anan ya dogara ne akan ƙirar izinin tsari, kuma ainihin tasirin yana buƙatar kimantawa tare da izinin turawa.

Rubutun CLI na yau da kullun ba su da shigarwar HTTP iri ɗaya; amma matakan da ke gudanar da ayyuka na waje na dogon lokaci a cikin CLI ko yanayin da aka saka ya kamata a haɗa su cikin kayan aikin lokaci da rayuwa. CMS, tsarin ko Composer dogara ne kawai aka sabunta kuma injin PHP da ke ƙasa ba a maye gurbinsa ta atomatik.

2. Dalilin bincike

2.1 Da farko fahimtar zagayowar rayuwa guda biyu

PHP worker sau da yawa yana sarrafa buƙatun da yawa a jere. Ƙwaƙwalwar da aka keɓance a lokacin buƙatar za a iya saki daidai gwargwado a ƙarshen buƙatar, yayin da ma’aikaci da kansa da wasu filayensa na duniya ke ci gaba da wanzuwa.

Don haka, injin dole ne ya kiyaye ƙuntatawa guda biyu:

  • Ƙuntataccen ƙaddamarwa: Bayanan da ake iya gani ga wasu lambobi dole ne su kasance cikin yanayin da za a iya karantawa, ketare, da lalata su cikin aminci.
  • Ƙuntataccen tsarin rayuwa : da zarar an saki ƙwaƙwalwar ajiyar buƙata, filayen da suka daɗe ba dole ba ne su ci gaba da kula da adireshi a cikin wannan ƙwaƙwalwar azaman ingantaccen yanayi.

Waɗannan ƙuntatawa guda biyu sun dace da manyan hanyoyin gazawar ƙungiyoyin raunin biyun. Tsarin da ke gaba shine bayanin tsari wanda ya haɗu da sanarwa da harhada faci. Ba yana nufin cewa kowane turawa yana da daidai hanya ɗaya da ake iya kaiwa ba. S2S3S5

2.2 CVE-2026-109618: OOM ya katse sabunta matsayin da ba a gama ba.

Tsohuwar aiwatarwa tana amfani da tsallen da ba na gida ba na nau’in longjmp() don ɗaukar OOM, kuma hanyar da ke da alaƙa tana fita mahallin aiwatar da yanzu ta hanyar zend_bailout(). Haɗarin shine cewa wani yanki na lambar C mai yiwuwa ya buga sabon abu, tsararru, ko neman matsayi zuwa wata lamba, amma har yanzu bai kammala duk ƙaddamar da filin ba; a wannan lokacin, duk wani gazawar rabo a lokacin da ya dace na iya haifar da tsallake matakan rufewa na yau da kullun. S2

Za a iya rarraba tsarin gazawar zuwa matakai huɗu:

  1. Ƙirƙiri ko sabunta tsarin buƙatun na ciki kuma sanya shi samun dama.
  2. Rarraba ƙwaƙwalwar ajiya na gaba ta gaza kuma an kunna OOM.
  3. Gudun aiwatarwa yana tsalle daga aikin na yanzu, kuma lambar da aka fara amfani da ita don kammala farawa ko dawo da yanayin ba a aiwatar da ita ba.
  4. Neman tsaftacewa yana ci gaba da sarrafa waɗannan sifofi kuma yana ɗaukar abubuwan da ba su da inganci azaman filaye ko adireshi masu inganci.

Batun ba shine gushewar ƙwaƙwalwar ajiya koyaushe yana haifar da RCE ba. Maimakon haka, gajiyawar ƙwaƙwalwar ajiya tana canza kwararar sarrafawa kuma ta keta tunanin injin game da ingantattun sifofi. Rarraba kasafi ba buƙatar haɗa kai tsaye da tsarin da aka karanta ba daidai ba. S2

Me yasa ƙananan buƙatun na iya ƙarewa daga ƙwaƙwalwar ajiya

Adadin bytes a jikin buƙatun da yawan amfanin da ake amfani da su bayan tantancewa ba iri ɗaya bane. Filin A na iya dacewa da igiyoyi masu yawa, abubuwa masu tsari da abubuwan metadata a cikin PHP; rikitaccen tsarin shigarwa zai shafi matakin haɓaka ƙwaƙwalwar ajiya.

Batutuwa tare da ɓangarori da yawa da aka jera a cikin sanarwar hukuma sun haɗa da: tazarar girman farko lokacin da akwai tsayin shela ya ɓace, adadin masu kai ga sashe ɗaya bai isa ya iyakance ba, kuma sarrafa fayil mara komai har yanzu yana samar da metadata, tare da sunaye suna ƙara haɓaka aikin tsararru. Buɗewar aikace-aikacen kansa, yankewa, ko sake fasalin shigarwa na iya zama tushen OOM. S2

Za a iya cimma matsaya ta tsaro guda biyu daga wannan:

  • Dole ne a aiwatar da hane-hane na jiki gwargwadon yiwuwa kafin shigar da PHP, kuma dole ne a yi la’akari da tsawon lokacin karantawa da rikitaccen tsari.
  • Ƙayyadaddun girman fayil daban-daban, adadin fayiloli, ko rufe tashar lodawa ɗaya kawai ba zai iya rufe duk tushen OOM ba.

Me yasa tantancewar aikace-aikacen na iya yin latti

A cikin mod_php, ana iya rarraba jikin buƙatar ta atomatik yayin lokacin ƙaddamar da buƙatar; ko da farawa ya gaza, za a yi aikin tsabtace buƙatun da ke da alaƙa. Tabbatar da hanyoyin kai hari na iya faruwa kafin lambar aikace-aikace. Don rage fallasa a wannan matakin, ana buƙatar sanya hani a wurin wakili na baya, uwar garken Web, ko wata iyaka wacce ta riga ta wuce aiwatar da buƙatar PHP. S1S2

2.3 CVE-2026-109619: An saki ƙwaƙwalwar ajiyar buƙatar, bayanin duniya har yanzu yana raye

Wannan batu ya ƙunshi kuskure, zama, abu, ko matsayi na tsawo: an adana filin a cikin wurin samun dama ga ma’aikaci na dogon lokaci, amma bayanan da filin ya yi nuni ne na buƙatu ɗaya. Muddin ba a tsaftace bayanin da kyau ba kafin a fito da tulin buƙatun, buƙatun na gaba na iya fuskantar yanayi mai raɗaɗi, suna yin amfani-bayan-free. S3

Binciken hukuma ya raba yanayin amfani zuwa “masu samarwa” da “masu amfani”:

rawar ko yanayima’anaAbubuwan da ke haifar da kariya
furodusa na jihaSanya jihar da wannan bukata ta mallaka a cikin wani wuri wanda har yanzu ana iya shiga daga bayaDon duba ko an gama tsaftacewar daidai bayan fita mara kyau
Matsayi ya rageBa a share shi ba, ko kuma an share shi sannan a sake cika shi ta hanyar wani aiki da aka makara.Share sau ɗaya kawai a farkon matakin rufewa bazai isa ba
sake amfani da ma’aikaciMa’aikaci ɗaya yana ci gaba da aiwatar da buƙatun na gabaMa’aikata da yawa bambancin tsari ne kawai, ba garantin amincin ƙwaƙwalwar ajiya ba
gaba mabukaciKaranta, saki ko ƙayyade ragowar ƙimar kafin a fara yanayin da ya dace akai-akai.Dole ne a duba INI, zaman da sauran hanyoyi kafin farawa

Waɗannan sharuɗɗan suna buƙatar haɗuwa tare; duk wani rajistan kuskure da kansa baya tabbatar da cewa an yi nasarar yin amfani da raunin. S3

Baya buƙatar OOM azaman buƙatun da ake buƙata

Kurakurai masu kisa na iya katse ɓangarorin ɓangarorin biyu da maidowa. Ƙirƙiri ko rarraba gazawar, kurakuran da ba a kama su ba, gazawar require, da ƙarewar aiwatarwa na iya barin wasu jihohi a baya. Binciken marasa mutuwa a ƙarshen tsaftacewa zai iya sake cika bayanan kuskure waɗanda aka riga an share su. S3

Don haka, canza memory_limit zuwa Unlimited baya rufe wannan sawun raunin.

”Kafin farawa” yana buƙatar kulawa daban

Lokacin nau’ikan nau’ikan masu amfani biyu da aka tabbatar sun bambanta:

  • Early INI diagnostics: Wasu jeri da aka yi amfani da su akan faɗakarwar batun buƙata, sanarwa ko yankewa kafin fara aiwatar da al’ada, da sarrafa bincike na iya samun dama ga tsohon yanayin kuskure.
  • ci gaban loda zaman : Za a iya aiwatar da zaman a gaba yayin aikin tantancewar jiki, amma tsarin na yau da kullun RINIT har yanzu ba a kammala ba; ba za a iya gane cewa hanyar ba ta wanzu saboda aikace-aikacen ba ya kira a bayyane session_start() . S3

Ba duka ba INI daidaitawa suna da lokacin haɗari iri ɗaya. Tsarin-matakin shugabanci na mod_php da kuma PHP_VALUE / PHP_ADMIN_VALUE ya shige ta FPM gaban-karshen bukatar a bambanta daga talakawa php.ini , FPM pool farawa sanyi da kuma FPM .user.ini . Waɗannan na ƙarshe suna da lokacin daidaitawa daban-daban kuma ba za a iya kiransu gaba ɗaya masu amfani da farko iri ɗaya ba. S3

Kashe display_errors, log_errors, rage error_reporting, ko amfani da @ kawai yana rinjayar ganuwa na ganewar asali; ƙila an sami isa ga yanayin cikin gida da ya dace kafin yanke shawarar ko za a fitar da log ɗin. S3

3. Gyara sigar da zaɓin faci

3.1 Official upstream gyara tushen tushe

Reshen PHP na yanzuSigar farko da ta ƙunshi wannan gyara na hukumaShawarwari
8.28.2.35Haɓaka zuwa wannan sigar ko sigar ta gaba mai ɗauke da gyare-gyare iri ɗaya
8.38.3.36Daidai da na sama
8.48.4.27Daidai da na sama
8.58.5.12Daidai da na sama
8.1 da sigar farkoBabban tallafi na gaba ya ƙareBa da fifikon ƙaura zuwa rassa masu tallafi; dubawa na ɗan gajeren lokaci ko LTS na baya na masana’anta

Sigar da matsayin tallafi sun dogara ne akan sanarwar hukuma ta PHP, kuma tushen lokacin shine Oktoba 22, 2026. S1

Waɗannan su ne mafi ƙarancin sigar da aka gyara a kowane reshe. Ba za a iya maye gurbinsu da wata sanarwa cewa kowace sigar da ke ƙasa 8.5.12 tana da rauni: iri irin su 8.2.35 da 8.4.27 a wasu rassan sun riga sun ƙunshi gyara.

3.2 Duba cikakken sigar fakitin rarrabawa

Distros sau da yawa yana ƙara gyare-gyaren tsaro bisa tsofaffin nau’ikan sama. yarda kuma yakamata a duba sigar sakin, tushen ma’ajiya, cikakken sigar fakiti da bayanin tsaro.

Misali, sigar fakitin gyara Ubuntu 24.04 LTS da aka jera don Ubuntu USN-8948-1 shine:

8.3.6-0ubuntu0.24.04.13

Sashin sa na sama har yanzu 8.3.6 ne, amma an haɗa cikakken sigar wannan rarraba a cikin wannan sanarwar gyarawa. Wannan ƙarshe ya shafi daidaitaccen rarraba da tushen fakitin kawai, kuma ba za a iya haɗa shi ga kowane gini wanda kuma ke nuna 8.3.6. S10

3.3 Zaɓin facin da ya dace

yanayiTsarin fifikoMabuɗin mahimmanci don karɓa
Amfani da fakitin PHP rarrabaShigar da sabuntawar tsaro da masana’anta suka fitarSanarwar ta ƙunshi duka CVE; cikakken sigar kunshin daidai ne
Yi amfani da ganga PHP na hukuma ko hoton da aka gina kaiSabunta lokacin aiki na tushe, sake ginawa da turawaMisalin gudu yana amfani da sabon hoton; duk tsoffin kwafi an fita
Rassan tallafi da aka tattara da kansaYi amfani da sigar tsaro ta wannan reshe ko cikakken saitin faci na hukumaDaidaita reshe, cikar dogaro, dacewar haɓakawa da wucewar koma baya
Bayani na 7.4, 8.0, 8.1Ba da fifikon mai siyarwa; kimanta reshen lambar tushen gaggawa ta hukuma idan ya cancantaGano canje-canjen ɗabi’a da tsara ƙaura zuwa nau’ikan da ke da tallafi

An fitar da faci na hukuma, kuma ya kamata a fara gyare-gyare na ainihi daga waɗannan facin. Snippets ɗin lambar a Sashe na 6 an yi niyya ne don kwatanta ƙira da bitar manyan bayanai kuma ba su zama cikakkiyar facin da za a iya amfani da shi da kansa ba. S1S4S6

4. Tsarin gyara na yau da kullun

4.1 Inventory Inventory na lokacin aiki wanda a zahiri ke sarrafa buƙatun

Ana ba da shawarar samar da taƙaitaccen leda don yin rikodi aƙalla:

  • Shigar suna ko sabis na yanki, baya-bayan wakili, PHP SAPI.
  • PHP reshe, cikakken sigar fakiti ko narkar da hoto, gina tushen.
  • FPM pool, ainihin sashin sabis, ganga ko Pod, adadin kwafi.
  • An ɗora abubuwan haɓakawa, babban tsari da ƙarin fayilolin sanyi.
  • Shin akwai wasu nau’ikan PHP, tsoffin kwafi na turawa, ko tashoshi na asali waɗanda za’a iya shiga kai tsaye?

Waɗannan shawarwarin aiwatarwa ne domin “ingantawa” zai iya dacewa da kowane ainihin shigarwar hanya. Musamman duba idan layin umarni PHP da Web PHP suna amfani da nau’o’i daban-daban, an gina hoton amma tsohuwar akwati tana gudana, wani ɓangare na tafkin ko kwafin ba a maye gurbinsa ba, da dai sauransu.

4.2 Zaɓi kuma ƙaddamar da sabuntawa daidai

Tabbatar da sigar gyara kamar yadda yake cikin Sashe na 3, zai fi dacewa ta amfani da amintaccen tushen fakitin ko sarkar ginin sarrafawa mai sarrafawa. Ya kamata iyakar ɗaukakawa ta haɗa da ɓangaren da a zahiri ke ɗaukar buƙatun, kamar fakitin FPM, ƙirar Apache PHP, binary CGI, ko ginin sabis ɗin da aka saka PHP.

Kafin haɓakawa, kiyaye tsari da lissafin fakiti, kuma tabbatar da farawa da mahimman sabis a cikin yanayi mai kama da samarwa. Don haɓakawa mai sarrafa kansa, bincika ginin kuma gudanar da dacewa daidai da sigar PHP. Dauki wani da alama yana da dacewa daga wani reshe baya bada garantin cewa an aiwatar da dukkan gyare-gyaren.

4.3 Sake farawa ko mirgine abubuwan da ke gudana

Shigar da fayil da loda sabon lamba a cikin tsari abubuwa ne guda biyu daban-daban. Ya kamata a sake kunna sabis ɗin da ya dace, ko kuma a kammala maye gurbin, kuma a tabbatar da cewa tsohon ma’aikaci da tsohon kwantena ya fita.

Don mod_php, sake kunna tsarin Apache wanda ke ɗaukar nauyin ƙirar. Sabis ɗin da suka haɗa PHP suna buƙatar maye gurbin tsarin tallan su. Don FPM, share OPcache baya maye gurbin sabunta lokacin aiki da tsofaffin ma’aikata masu ritaya.

Lokacin amfani da musanyawa mai kyau, kuna buƙatar bincika ko tsarin tsararru yana ci gaba da ɗaukar doguwar haɗi ko fitattun buƙatun. Rikodin karɓa yakamata ya haɗa da ainihin sabis, sigar turawa, canjin lokacin kammalawa, da sakamakon ficewar tsohon misali.

Tabbatar da 4.4 ta ainihin buƙatun Web

Ana ba da shawarar haɗa waɗannan shedu masu zuwa maimakon dogaro kawai da umarnin sigar guda ɗaya:

shaidaMe za a iya tabbatarwaBa za a iya tabbatar da komai shi kaɗai ba
Manajan fakiti ko metadata hotoTushen shigarwa da cikakkun abubuwan ginawaAn canza zirga-zirga zuwa wannan misali
Matsayin tsari da turawama’aikaci ko kwantena ya kammala maye gurbinDole ne a tura ƙofar waje zuwa gare ta
Ƙuntataccen sakamakon bincike ana samun isa ga ta hanyar tashar gaskeAinihin Web SAPI da daidaitawar aikiKo bayanan baya ya rufe CVE guda biyu
Sanarwa mai siyarwa ko cikakken rikodin faciAn haɗa wannan gyaran kwaro a cikin wannan gininAna tura duk kwafi

PHP_VERSION, PHP_SAPI, fayilolin sanyi da aka ɗora, da saitunan gaggawa ana iya bincika su ta hanyar iyawar bincike na ciki, ko hanyoyin bincike na wucin gadi da sarrafawar samun dama. Tabbatar ba a mayar da buƙatar kai tsaye ta hanyar CDN ko cache shafi ba; cire shigarwar bincike na wucin gadi idan an gama.

php -v yawanci yana nuna binary CLI a halin yanzu da aka zaɓa ta hanyar harsashi; umarni kamar php-fpm -i ba daidai yake da tabbatar da ma’aikacin da ke karɓar zirga-zirga ba. Kada a bijirar da cikakken shafin phpinfo() zuwa cibiyar sadarwar jama’a na dogon lokaci.

4.5 Binciken koma bayan kasuwanci da cire saitunan gaggawa

Tabbatar da shiga na yau da kullun, karatun zaman da rubutu, tsari da lodawa, shigo da kaya, sarrafa kuskure da kwanciyar hankali na ma’aikaci a kusa da ayyukan da wannan canjin ya shafa. Bincika ko ƙimar kuskure, jinkirin amsawa, kololuwar ƙwaƙwalwa, fitar tsari da sake gina mitar ba su da kyau.

Idan an saita memory_limit=-1 na ɗan lokaci, za a dawo da iyakacin kasafin kuɗin da ya dace da ƙarfin kasuwanci bayan facin hukuma ya fara aiki; idan an saita pm.max_requests=1, za’a dawo da tsarin yanayin rayuwar da aka kimanta iya aiki bayan an tabbatar da gyara. Za a iya kiyaye iyakokin girman shigarwar da ikon samun damar tushen kamar yadda buƙatun kasuwanci suka faɗa.

Idan al’amurran da suka shafi dacewa sun taso yayin haɓakawa, yakamata a ba da fifiko ga dakatar da tashar tashar da abin ya shafa, ƙuntata hanyarta ta waje, ko daidaita aikace-aikacen kafin juyawa baya. Ba da izinin lokacin aikin da ba a gyara ba kai tsaye don yin hidima ga hanyar sadarwar jama’a zai sake buɗe ainihin haɗarin.

5. Matakan ragewa lokacin haɓakawa nan take ba zai yiwu ba

Wannan sashe an yi niyya ne don rage fallasa na ɗan lokaci ko inganta samuwa. Kowane ma’auni kawai yana rufe takamaiman hanya, kuma haɗuwa da ma’auni masu yawa ba daidai ba ne da cikakken gyarawa. S1S2S3

5.1 Ba da fifikon sarrafa zirga-zirga kafin PHP

Idan sabis ɗin ya ba shi izini, ɗan ɗan taƙaita mahimman wuraren ƙarewa zuwa amintattun tushe ko tilasta ikon samun dama kafin PHP. Don loda kayan aiki, iyakance girman buƙatun-jiki, ƙidayar filin, ƙididdige sashi, masu kai kowane bangare, da zurfin gida. Ayyukan da ba sa buƙatar ɓangarori da yawa na iya ƙin yarda da shi a gaban gaba. S2

Waɗannan hane-hane don rufe duk hanyoyin shiga PHP. Tsayar da URL mai suna “loading” kawai zai rasa sauran shigarwar da har yanzu PHP ke tantancewa ta atomatik a jikin buƙatar. Don lokuta kamar chunked canja wuri, rashin samuwa bayyana tsawon, da dai sauransu, iyaka ya kamata a dogara a kan ainihin girman girman karanta; aikace-aikacen kuma yakamata ya kasance yana da nasa kasafin kuɗin fitarwa lokacin da ake ragewa ko fadada abun cikin kuma.

5.2 FPM pool samfurin sanyi

Sanya saitunan masu zuwa a cikin sashin daidaitawa na FPM pool wanda a zahiri ke ba da buƙatun, ba a zahiri ba a cikin php.ini. Ƙimar 8M da 4M misalai ne don daidaitawa don nauyin aiki. Bar daki don filayen tsari da iyakoki da yawa lokacin iyakance duk buƙatar POST. S11S12

; Temporary mitigation: evaluate capacity before applying.
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M
php_admin_value[upload_max_filesize] = 4M
php_admin_flag[session.upload_progress.enabled] = off

PHP 8.5 kawai, da:

php_admin_flag[fatal_error_backtraces] = off

Ayyuka da iyakokin kowannensu sune kamar haka:

Kanfigareshantasirin da ake tsammaniBayanin ƙuntatawa waɗanda dole ne a riƙe
memory_limit=-1Cire abin da ake iya faɗin PHP buƙatun ƙwaƙƙwaran ƙayyadaddun ƙimaBa ya hana gazawar kasafi; soke ainihin kasafin kuɗi na iya ƙara haɗarin ƙarancin ƙwaƙwalwar ajiya da katsewar sabis.
Karamin post_max_sizeRage girman bayanan shigar da tsarin tantancewaFassarar da ba a kayyade ba yana da sananne gibi; Ba za a iya hana haɓaka ƙwaƙwalwar ajiya da kansa ba
upload_max_filesize < post_max_sizeIyakance girman fayil guda ɗaya da ajiyar buƙatun sararin samaBaya takura duk filaye, metadata, ko rabon in-app
Rufe ci gaba na lodawaToshe hanyar da ta danganci zaman da aka tabbatarBa ya rufe sauran bambance-bambancen jihohi na duniya
PHP 8.5 na kusa da baya mai mutuwaToshe an tabbatar da masu samar da matsayi masu alaƙaBaya rufe wasu hanyoyi kamar zaman

Iyakokin ma’auni sun fito ne daga sanarwar hukuma; don tafki syntax da na’urorin daidaita matakan gudanarwa, duba PHP manual. S1 S2 S3 S11

Saitunan matakin gudanarwa na php_admin_* ba za a iya soke su ta aikace-aikace ta hanyar ini_set() ba. Duk wuraren tafki, matakin-directory da saiti masu shigowa gaba-gaba yakamata a sake duba su don tabbatar da cewa ƙimar buƙatun na ainihi kamar yadda ake tsammani. Bayan gyare-gyare, sake gina duk ma’aikaci don hana hanyoyin da ake da su ci gaba da riƙe tsohuwar jihar.

Idan ka zaɓi canza php.ini kai tsaye, ya kamata a canza ma’anar zuwa:

memory_limit = -1
post_max_size = 8M
upload_max_filesize = 4M
session.upload_progress.enabled = Off

Ba kamar php_admin_value a tafkin ba, saita memory_limit=-1 a cikin php.ini baya hana app ɗin sake gyara shi. Ya kamata a duba tsarin tsarin, lambar aikace-aikacen, da sauran saitunan don ganin idan sun sake saita iyakataccen ƙimar; lokacin da ake buƙatar aiwatarwa, yi amfani da saitunan matakin gudanarwa da suka dace da SAPI na yanzu kuma duba ainihin ƙimar inganci. S11S12

Ƙara fatal_error_backtraces = Off kawai don PHP 8.5. Kar a yi amfani da matakin aikace-aikacen ini_set() azaman hanyar warwarewa don murkushe ci gaban loda, kuma kar a dogara ga FPM .user.ini don yin tasiri kafin buƙatar yin nazari. S1S3

5.3 Sarrafa farashin cire iyakokin ƙwaƙwalwar PHP

memory_limit=-1 hanya ce ta wucin gadi don wuraren da ba a kayyade ba kuma bai kamata a kwafi shi azaman tsayayyen tsoho na dogon lokaci ba. Lokacin da aikace-aikace ko buƙata suka fita daga sarrafawa, zai iya amfani da ƙarin ƙwaƙwalwar ajiyar mai watsa shiri. Don haka, kafin amfani, yakamata ku kimanta adadin ma’amala, kololuwar ma’aikaci ɗaya, da jimillar ƙarfin sabis, da tura iyakokin shigarwar gaba-gaba. S2

Matsakaicin kwantena ko rukuni na iya samar da iyakoki na samuwa amma ba da garantin cewa rabon kuɗi ba zai taɓa kasawa ba; Ana iya dakatar da duka kwantena, maigidan, da duk ma’aikaci lokacin da aka kunna iyaka. Ana buƙatar ƙididdige ƙima da dabarun ƙarewa tare da turawa kuma ba za a iya kiran cikakken kariya ga waɗannan CVE guda biyu ba. S2

Kar a musanya dabarun da ke sama da RLIMIT_AS, RLIMIT_DATA, ko tsarin tsare-tsaren da ya dace daidai da ƙuntatawar sararin samaniya; za su iya haifar da kasafi kai tsaye zuwa ga hanyar OOM mai matsala. S2

Misalin Kanfigareshan 5.4 Nginx

Ana amfani da turawa inda Nginx ke tura buƙatun zuwa PHP-FPM. Ana iya saita shi a matakin daidaitawa na ainihin sabis ɗin baƙi:

client_max_body_size 8m;
fastcgi_request_buffering on;

client_max_body_size yana iyakance girman jikin buƙatun; fastcgi_request_buffering on yana ba da damar Nginx ya karanta cikakken jikin buƙatar da farko sannan a aika shi zuwa ga baya na FastCGI. Ko yana da tasiri a cikin takamaiman server ko location yana buƙatar bincika tare da haɗin gwiwar gado da ɗaukar hoto. S13S14

kawai lokacin da kasuwancin baya buƙatar multipart, zaku iya ƙara ƙa’idar kin amincewa zuwa madaidaicin ƙofar sabis:

if ($http_content_type ~* "multipart/form-data") {
    return 403;
}

Wannan samfuri ne mai sauƙi na ƙuntatawa shigarwa ta amfani da if da return, ba ƙa’idar tace gabaɗaya ba don rashin lahani. Tabbatar da tsarin daidaitawa da buƙatun al’ada kafin turawa, kuma duba ko al’adar error_page tana tura buƙatun 403 zuwa PHP. Daidaitan igiyoyi baya bayar da cikakken garanti akan duk bambance-bambancen bincike. S15

Bugu da ƙari, waɗannan saitunan ba su iyakance adadin bayanai ta atomatik, adadin filayen, ko adadin PHP abubuwan da za a iya ragewa ta hanyar aikace-aikacen; kasuwancin da ke buƙatar loda yakamata suyi amfani da ƙarin ƙuntatawa waɗanda suka fahimci tsarin buƙatun su.

5.5 Ragewar zaɓi: buƙatu ɗaya ga ma’aikacin FPM

Don ƙaddamar da FPM waɗanda za su iya ba da kuɗin sama, za a iya ƙididdige saitin gajeren lokaci:

pm.max_requests = 1

Kuma sake gina ma’aikacin da yake yanzu. Yana toshe sarkar buƙatun giciye da aka kwatanta a matakin sake amfani da ma’aikaci, amma zai ƙara ƙirƙira tsari da ƙaddamarwa sama da sama; a lokaci guda, ba zai iya gyara buƙatun guda ɗaya OOM da abubuwan tsaftacewa na CVE-2026-109618. Lokacin da ƙimar ta yi ƙasa da 1, har yanzu akwai buƙatar sake amfani da taga. S3S11

5.6 WAF da Cloudflare iyakoki

Cloudflare ya sanar da shirye-shiryen turawa don kariya daga PHP2Shell, gami da shirin Free. Lokacin amfani da sabis ɗin sa, yakamata ku bincika ko ainihin zirga-zirgar ababen hawa ta ratsa cikin wakili, ko dokokin kariya suna aiki, da kuma ko za’a iya ketare wurin asalin kai tsaye; don tsare-tsaren da aka biya, kuna buƙatar bincika tsari da keɓanta na Dokokin Gudanarwa masu dacewa. S16

Wasu daga cikin abubuwan ganowa da mai siyar ya bayyana suna amfani da siginonin amsawa, don haka ba za a iya fassara duk kariyar da cewa “an toshe kowane hari kafin a kai ga PHP”. WAF na iya taimakawa rage hasashe da samar da bayanan lura, amma ci gaba da haɓakawa zuwa PHP har yanzu yana da mahimmanci. S16

5.7 Me yasa matakan gama gari basu isa ba

matakan ko hukuncikasawa
Kusa kawai file_uploadsBa za a iya rufe duk sarrafa sassa da yawa da amfani da nata hanyar OOM ba
Saita enable_post_data_reading=OffCanja halin cika POST/FILES ta atomatik; Har yanzu aikace-aikacen na iya karanta jikin buƙatar kuma yana iya rushe kasuwancin yau da kullun
Kashe nunin kuskure, shiga ko amfani da @Har ila yau, sarrafa bincike na cikin gida na iya shiga cikin halin da ake ciki
Ƙara yawan ma’aikaciKada a kafa amintaccen tsarin tsaftace jihar, ko kawar da sake amfani da ma’aikaci ɗaya
Saita disable_functions ko open_basedir kawaiWaɗannan iyakoki ba sa gyara lalacewar ƙwaƙwalwar ƙirar injin C
Duba siga ko kwafi ɗaya kawai sau ɗayaBa za a iya tabbatar da cewa an maye gurbin duk mashigai da abubuwan da ke gudana ba
Ba a ga gundumomi togiyaBa zai iya tabbatar da cewa rashin lafiyar ba ya wanzu ko kuma ba a yi amfani da shi ba a da.

Daga cikin su, ana iya samun tushen tsarin sanyi da rauni na PHP a cikin S2S3S12; hukunce-hukunce game da ɗaukar hoto, yarda da iyakokin izini sun dogara ne akan shawarwarin aiwatarwa da waɗannan hanyoyin suka gabatar.

6. Ra’ayoyin aiwatarwa da wuraren bita na facin hukuma

6.1 Yi amfani da cikakkun gyare-gyare don madaidaicin reshe

Wakilin ƙaddamarwa na hukuma don PHP 8.5 shine:

31c0ea7d7ff1d1fccb6492e52dab544011628065
Avoid state corruption via bailout

Alƙawarin ya haɗa kai tsaye CVEs guda biyu, duka don daidaita hanyar fita OOM da kuma daidaita yanayin duniya wanda za’a iya isa ga lokacin farawa. Submitaddamar da shafi mai cikakken bambanci duba S4S5. Ya kamata sauran rassan su yi amfani da nasu bayanan tsaro na hukuma ko madaidaitan faci, kuma ba za a iya ɗauka cewa canje-canje zuwa 8.5 za a iya amfani da su kai tsaye zuwa kowane tsohon sigar.

Gyara 6.2 OOM Gyara: dawo da yanayin da ake iya sarrafawa da farko, sannan ƙare buƙatar

Tsarin aiwatarwa na yau da kullun yana gabatar da matakai guda biyu na aiki mai laushi da wuyar OOM: lokacin da aka kai iyakar taushi, ana yin rikodin matsayi na jiran aiki, kuma ana aiwatar da fitar da sarrafawa a wuri mai aminci kamar VM; madaidaicin kasafi mai kasawa yana bawa mai kira damar sarrafa gazawar a bayyane. Don rabon da ba zai iya dawo da gazawa kai tsaye ba, idan ana sa ran za a ƙetare madaidaicin ƙofa, za a ƙare tsarin kai tsaye don guje wa ci gaba da aiwatar da buƙatun a cikin tsaka-tsaki mara aminci. S2S5

Mai zuwa wani yanki ne na lambar maɓalli a cikin bambance-bambancen 8.5 da aka yi amfani da shi don alamar OOM mai jiran gado:

EG(delayed_oom).state = ZEND_OOM_STATE_PENDING;
zend_atomic_bool_store_ex(&EG(vm_interrupt), true);

VM ya katse kulawa da sauran wurare masu aminci daga baya a kira zend_handle_delayed_oom(). Mahallin aiwatar da lambar mai amfani da shi yana amfani da hanyar unwind mai sarrafawa; Hanyar OOM mai wuya ta kira _exit(137). S5

Daga mahangar ƙira, mahimman canje-canjen sune: avoids suna ketare tarin kira na C ba da gangan ba lokacin da tsarin ke cikin tsaka-tsakin yanayi, kuma yana sanya mafita a wani wuri wanda zai iya kiyaye iyakokin jihohi. Bayan ƙayyadaddun ƙayyadaddun ƙayyadaddun ƙayyadaddun ƙayyadaddun ƙayyadaddun ƙayyadaddun ƙayyadaddun ƙwaƙwalwar ajiya na iya buƙatar ƙarin ƙwaƙwalwar ajiya don kammala aikin, don haka ba za a iya fahimtar sabon ƙofa mai laushi a matsayin cikakkiyar iyaka ga jimillar ƙwaƙwalwar ajiya na tsari ba.

Haka kuma ba za a iya taƙaita shi da cewa “PHP ya share duk zend_bailout()”. Faci har yanzu yana amfani da hanyoyin da suka dace a cikin takamaiman mahallin; Abin da aka gyara shine lokacin fita mai haɗari da kuma rakiyar gudanarwar jihar. S5

6.3 Ɗaukaka masu kira da keɓancewa da rarraba sassa da yawa tare

Idan kawai ka canza aikin rarrabawa zuwa “dawo NULL akan gazawa” kuma ainihin mai kira har yanzu yana ɗauka cewa ana dawo da ma’ana mai inganci koyaushe, zaku gabatar da sabbin hanyoyin shiga mara amfani ko tsaftacewa mara cika. Facin da ba a iya kasaftawa a cikin facin yana buƙatar sake dubawa tare da duba mai kira da keɓanta yaduwa. S5

gyare-gyare masu alaƙa da ɓangarori da yawa kuma sun haɗa da yin ƙididdigar tarawa dangane da ainihin ƙarar karantawa, rage sarrafa kanunan da ba su da amfani ko kwafi, da ɗaukar daidaiton fita da dabaru na tsaftacewa lokacin da OOM ke jiran. Waɗannan canje-canjen duka suna rage haɓaka kayan aiki kuma suna sa mai binciken ya bi sabuwar yarjejeniya ta OOM. S5

Ga ƙungiyoyin da ke kula da nasu rassan, ana ba da shawarar cewa batutuwa masu zuwa su zama abin da aka fi mayar da hankali kan bitar lambar:

  • Shin jihar tana iya ganin duniyar waje kafin a fara ta gaba daya?
  • Bayan gazawar kasafi ko keɓantawa na sake kira, mallakin har yanzu na musamman ne kuma babu shakka?
  • Shin za ku iya isa ga haɗaɗɗen mafita na tsaftacewa idan kun gaza tsakiyar hanya?
  • Aikin tsaftacewa na iya gane filayen da ba a fara ba ko kuma ‘yantacce?
  • Shin lissafin kasafin kuɗi ya dogara ne akan ainihin ƙimar sarrafawa, ba kawai aminta da da’awar buƙatun ba?
  • Duk masu kira sun kula da sabuwar ƙimar dawowar gazawar?

Waɗannan tambayoyin bita ne da aka taƙaita bisa tsarin gyarawa, kuma ba ƙarshen binciken da aka kammala ba don tushen lambar da ba a samar ba.

6.4 Gyara buƙatun giciye: farawa a baya, tsaftacewar ƙarshe daga baya

Daidai da CVE-2026-109619, facin yana daidaita iyakoki da yawa na rayuwa a lokaci guda. Fayilolin da ayyukan da aka jera a ƙasa suna ɗaukar bambancin hukuma na PHP 8.5 azaman misali. S5

wuricanza hanyaAn warware matsalar
Zend/zend_execute_API.c da dai sauransu.Sake saita matsayin mai zartarwa kamar kurakurai, keɓantawa, masu sarrafa, abubuwa, da sauransu.Bayan buƙatar ta ƙare, har yanzu akwai tsoffin nassoshi waɗanda za a iya isa ga buƙatun na gaba.
Hanyar farawa na main/main.cKira php_basic_early_rinit() kafin a kunna SAPILokacin da farkon mabukaci ya faru, yanayin da ya dace ba a fara ba tukuna.
Hanyar kusa da main/main.cRusa HTTP globals kuma yi masa alama a matsayin wanda ba a bayyana shi baƘimar da aka saki har yanzu ana ɗaukar abu mai inganci
kafin a saki tarin bukatar a karshesake share saƙon kuskure na ƙarsheBinciken tsaftar marigayi yana sake cika matsayin kuskure
ext/session/session.cci gaban uploading Hanyar farko an fara zama na farko na duniyaRINIT na yau da kullun an sami dama ga tsohuwar jihar
Lambar mai alaƙa da serializationIyakance nazarin aji da kiran mai amfani a farkon aikiYi ƙarin lambar mai amfani lokacin da farawa bai cika ba

Misali, jerin farawa sun haɗa da:

zend_activate();
php_basic_early_rinit();
sapi_activate();

Bayan an lalata HTTP globals, ƙara alamar gazawar matsayi:

zval_ptr_dtor(&PG(http_globals)[i]);
ZVAL_UNDEF(&PG(http_globals)[i]);

Wadannan ayoyin suna misalta ka’idoji guda biyu: fara kafin farkon yiwuwar mabukaci, da kuma aiwatar da tsaftacewar ƙarshe bayan aikin ƙarshe wanda zai iya sake haifar da jihar. Sake saitin mai nuni kawai yayin al’ada RINIT ko matakin rufewa na baya na iya ɓacewa a baya ko kuma daga baya. S5

6.5 Me yasa ba a ba da shawarar yin “gyaran layi daya” na kanku ba?

Maye gurbin duk zend_bailout() tare da _exit(), ko kawai ƙara rajistan ma’ana mara kyau a wata shigarwa, zai ƙunshi adadi mai yawa na mahallin kisa daban-daban. Suna iya ƙetare wasu filayen matsayi, ko kuma za su iya canza lalacewa, tsawaita kiran dawo da kira, aiwatar da ɗaukar hoto, da neman ƙarshen fassarar.

Don nau’ikan da aka goyan baya, cikakkun gyare-gyaren da aka riga aka fitar suna kan gaba. Ya kamata ƙaura na rassan nasu ya yi rikodin tushen faci, ginshiƙai masu dacewa, magance rikice-rikice da sauye-sauyen ɗabi’a, da kuma amfani da shari’o’in amfani da koma baya masu dacewa da tabbatar da wannan tsarin kasuwanci. Shawarwari a nan sun fito ne daga nazarin iyawar facin a fadin mai raba, VM, zama da neman sauye-sauye na rayuwa. S4S5

7. Gaggawa ta baya na PHP 7.4, 8.0, 8.1

PHP bisa hukuma yana ba da mafi ƙarancin lambar tushe na tsoffin rassa uku dangane da tsananin. Sunayen reshe sune:

PHP-7.4-CVE-2026-109618-109619
PHP-8.0-CVE-2026-109618-109619
PHP-8.1-CVE-2026-109618-109619

Don hanyoyin haɗin reshe, duba S7S8S9. Waɗannan isarwa na gaggawa ne don wannan raunin kuma baya wakiltar komawa zuwa tallafi na yau da kullun don tsohon reshe, kuma ba sa maye gurbin wasu sabunta tsaro. S1

7.1 Dauki PHP 8.1 a matsayin misali

Abubuwan da suka dace don PHP 8.1 sune:

1d7dec178a094e6e75b229ce22754045f8c6070a

Dabarunsa sun fi son kasawa da sauri: kiran _exit(1) bayan fitar da bincike a cikin hanyar OOM mai dacewa, kuma ya haɗa da matsayi na duniya da sauran gyare-gyare masu dacewa; yayin da ciki yana kashe daidaitaccen aiki na ci gaba da loda zaman. Don ƙaddamar da lambar tushe mai dacewa, duba S6.

Wannan bambanci ne na ɗabi’a daga mafi cikakken jinkirin ƙira na OOM a cikin reshen da aka goyan baya. Kawai saboda tsarin har yanzu yana nuna cewa ci gaban lodawa yana kunne, ba yana nufin cewa yanayin sarrafa ciki ba bayan wannan baya ba zai canza ba.

7.2 Farashin da kuke buƙatar karɓa lokacin turawa

Fitar da tsarin kai tsaye na iya haifar da buƙatar yanzu ta gaza, tsallake kiran dawo da kiran na PHP na al’ada da ɓangaren rufe aikace-aikacen; idan mai watsa shiri ya ɗauki samfurin zaren, kuma ya zama dole a kimanta tasirin duk hanyar fitawar rundunar a kan sauran ayyukan da suka dace. Ko mai sarrafa tsari zai iya cire tsarin maye gurbin a cikin lokaci kuma ya kamata a haɗa shi cikin tabbatarwa.

Don haka, masu amfani da tsofaffin nau’ikan yakamata suyi la’akari da tsari:

  1. Yi ƙaura zuwa reshen PHP mai goyan baya da tsayayyen sigar sa.
  2. Yi amfani da sakin da ke rufe duka CVE ko sabunta masana’anta na LTS.
  3. Idan da gaske yana ƙarƙashin tsohuwar sigar lambar tushe, yi amfani da bayanan gaggawa na hukuma na sigar da ta dace don tabbatar da cikakkun canje-canje da dacewa, da shirya ƙaura na gaba.

“Mafi ƙarancin baya” anan yana bayanin dacewa da iyawar aiwatarwa wanda jami’in ya zaɓa, kuma bai kamata a fassara shi kai tsaye da “sananan gyare-gyaren rashin cikawa ba”. Ya kamata ku yi hukunci bisa tushen lambar tushe na reshe mai dacewa da sanarwar masana’anta, kuma kada ku share canje-canje masu goyan baya da kanku. S1S6

8. Sharuɗɗan yarda da bin diddigin binciken

Ana ba da shawarar cewa a yi amfani da sakamako masu zuwa a matsayin tushen kammala wannan gyara:

Abubuwan karɓaMatsayin kammalawa
ɗaukar hoto mai rauniGina ko sanarwar mai siyarwa tana gyarawa CVE-2026-109618 da CVE-2026-109619
ɗaukar hotoDuk hanyoyin shiga, wurin waha, ayyuka da kwafi suna amfani da lokacin aiki da aka gyara
Tsarin yana aikiTsohuwar ma’aikaci, tsohuwar tsarin masaukin baki da tsohuwar kwantena duk fita
Tabbacin buƙatun gaskeAn tabbatar da SAPI, ginawa kuma an daidaita shi tare da ainihin hanyar haɗin Web don kawar da kuskuren cache
samuwan kasuwanciMaɓallin ayyuka kamar zaman, lodawa, shigo da kaya, da sarrafa kuskure sun dawo akai-akai.
Ƙare matakan wucin gadiƘwaƙwalwar ajiya mara iyaka da matsananciyar tsarin sake yin amfani da ma’aikata bisa ga tsarin iya aiki ko kuma suna da tabbataccen dalili na riƙewa.
Shaidar canjiYi rikodin nau’in fakiti ko narkar hoto, iyakar ɗaukaka, lokacin kammalawa da sakamakon tabbatarwa

Abubuwan da ke sama sune shawarwari don aiwatarwa. Idan kana buƙatar tabbatar da halayen OOM, fita mara kyau, ko faci na al’ada, yakamata kayi amfani da gwajin juzu’i ko alluran kuskure a cikin keɓantaccen yanayi don gujewa ƙirƙira gajiyawar ƙwaƙwalwa akai-akai a cikin yanayin samarwa azaman hanyar karɓa.

Hakanan duba PHP mai kisa, haɗarin ma’aikaci, sake kunnawa mara kyau, ƙimar kuskure da abubuwan WAF kafin da bayan sabuntawa. Logs na iya ba da alamun bincike kawai: abin da ya faru na OOM ba yana nufin an yi amfani da shi ba, kuma rashin ƙararrawa baya tabbatar da cewa babu wani amfani da ya faru. Haɓakawa yana gyara hanyoyin raunin da za a iya kaiwa nan gaba; idan an sami abubuwan da ba su dace ba kamar tampering file ko leakage na shaida, yakamata a gudanar da binciken abubuwan da suka faru daban-daban.

Karin bayani: Abubuwan da aka kawo da kuma hanyoyin haɗin gwiwa

Ana tattara duk hanyoyin haɗin yanar gizo a ƙasa. Shawarwari, faci, da jagorar dillalai suna yin la’akari da cak kamar na Oktoba 22, 2026; abubuwan turawa na gaba yakamata su duba sabuntawar dillali. Ƙididdigar ƙididdiga a cikin rubutun suna nufin waɗannan shigarwar.

S1 - PHP bayanin tsaro na hukuma da sigar gyara

  • Tushen: Project PHP, Oktoba 21, 2026.
  • Manufar: Iyalin haɗari, nau’ikan gyaran hukuma guda huɗu, matakan wucin gadi na hukuma da umarnin dawo da gaggawa na tsoffin rassan.
  • Hanyar haɗi: PHP 2026 This security bulletin yana cikin tarihin tarihin shekara-shekara

S2 - CVE-2026-109618 Takardun Fasaha

  • Tushen: php/php-src GitHub Security Advisory, Oktoba 21, 2026.
  • GHSA-w8hw-w9fx-j79w.
  • Manufa: Iyakar ɗaukar hoto don OOM, haɓaka sassa da yawa, bambancin SAPI da ragewa.
  • RCE via OOM corruption

S3 - CVE-2026-109619 Takardun Fasaha

  • Tushen: php/php-src GitHub Security Advisory, Oktoba 21, 2026.
  • GHSA-6wmf-4rv5-p3rp.
  • Manufa: Jiha mai ratsawa da neman ƙetare, masu samarwa da masu amfani, farawa da wuri, rage sanyi.
  • RCE via stale global state

S4 - PHP 8.5 ƙaddamar da gyara na hukuma

  • Tushen: php/php-src.
  • 31c0ea7d7ff1d1fccb6492e52dab544011628065.
  • Manufa: Tabbatar da ƙaddamarwa na yau da kullun don gyara lahani guda biyu a lokaci guda, da kuma bayyana alkiblar canji gabaɗaya.
  • Avoid state corruption via bailout

S5 - PHP 8.5 bisa hukuma an dawo dashi kuma cikakke

  • Source: bambanta daga wannan ƙaddamarwar hukuma.
  • Manufar: Bincika takamaiman aiwatar da allocator, VM, HTTP globals, zaman, serialization da buƙatar sake zagayowar rayuwa.
  • official complete diff

S6 - PHP 8.1 ƙaddamar da bayanan gaggawa na hukuma

S7 - PHP 7.4 reshen baya na gaggawa na gaggawa

S8 - PHP 8.0 reshen baya na gaggawa na gaggawa

S9 - PHP 8.1 reshen baya na gaggawa na gaggawa

S10 — Ubuntu Bayanin Tsaro USN-8948-1

Bayanan Bayani na S11-PHP-FPM Configuration

  • Tushen: PHP daftarin aiki na hukuma.
  • Maƙasudi: Ƙa’idodin daidaitawa kamar php_admin_value, php_admin_flag, pm.max_requests, da sauransu.
  • PHP-FPM Configuration

S12 - PHP Core INI Jagoran Kanfigareshan

  • Tushen: PHP daftarin aiki na hukuma.
  • Manufa: Ma’ana da iyakokin jikin buƙatu, ƙaddamarwa, ƙwaƙwalwar ajiya da daidaitawar karanta POST ta atomatik.
  • Description of core php.ini directives

S13 - Nginx buƙatar iyakar girman jiki

S14-Nginx FastCGI buffer buffer

S15 - Nginx Yanayin da umarnin dawowa

S16 - Cloudflare PHP2Shell Umarnin Kariya