{"id":183943,"date":"2026-10-22T05:40:56","date_gmt":"2026-10-22T03:40:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/raskryty-detali-kriticheskih-uyazvimostej-v-php-i-opublikovany-korrektiruyushhie-obnovleniya"},"modified":"2026-10-22T05:41:02","modified_gmt":"2026-10-22T03:41:02","slug":"details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released","title":{"rendered":"Otkriveni su detalji kriti\u010dnih ranjivosti u PHP-u i objavljena su a\u017euriranja koja ih ispravljaju.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Objavljene su ispravke za PHP 8.5.12, 8.4.27, 8.3.36 i 8.2.35, kao i zakrpe za verzije PHP 7.4, PHP 8.0 i PHP 8.1 koje vi\u0161e nisu podr\u017eane (ranjive verzije od 5.4 do 7.3 ostaju bez zakrpa), u kojima su ispravljene dve kriti\u010dne ranjivosti:<\/p>\n<ul>\n<li class=\"l\"> CVE-2026-109618 \u2014 daljinsko izvajanje kode, ki je posledica dejstva, da lahko ob iz\u010drpanju razpolo\u017eljive procesorske prostorske pomnilnika obdelovalec pomanjkanja pomnilnika prek izvajanja funkcije longjmp() prekine PHP-interpretator v stanju, ko je inicializiran le del notranjih struktur, povezanih z obdelavo zahteve. V nadaljevanju funkcija zaklju\u010dka obdelave zahtevka naslova na te strukture kot \u017ee inicializirane, \u010deprav pomnilnik zanje ni dodeljen.\n<p>Glavni vektor napada je manipulacija sa multipart zahtevima kako bi se stvorili uslovi za iscrpljenje raspolo\u017eive memorije. Da bi se zaobi\u0161ao limit post_max_size, mo\u017ee se izostaviti Content-Length header i poslati ogroman broj HTTP headera. Tako\u0111e, mogu se izvesti i ciljani napadi na konkretne operacije u PHP aplikacijama koje prekomerno tro\u0161e memoriju. Eksploitacija je potvr\u0111ena za mod_php, jer poziva funkciju shutdown() \u010dak i u slu\u010daju gre\u0161ke. PHP-FPM \u0107e prekinuti podproces pri gre\u0161ci, \u0161to ote\u017eava izvr\u0161enje napada, ali teoretski to ne isklju\u010duje. <\/p>\n<li class=\"l\"> CVE-2026-109619 \u2014 daljinsko izvajanje kode, ki je posledica dostopa do pomnilnika po njegovi osvoboditvi zaradi nepravilnega \u010di\u0161\u010denja globalnega stanja, povezanega s specifi\u010dno zahtevo. V primeru prekinitve zahteve zaradi fatalne napake, \u010dasovnega izteka ali pomanjkanja pomnilnika lahko globalno stanje ostane neponastavljeno in kazalci ostanejo aktivni, kljub osvobojeni pomnilniku, na katero se sklicujejo. Pri obdelavi naslednje zahteve v istem procesu lahko pride do dostopa prek preostalega kazalca do starega globalnega stanja.\n<p>Za delovanje se lahko ustvari situacija, kjer se zmanj\u0161a razpolo\u017eljiva pomnilni\u0161ka kapaciteta pri obdelavi multipart poizvedb v kodi za indikacijo napredka nalaganja (session.upload_progress). V tem primeru se kot glavni in potrjen vektor napada omenja obdelovalec fatal_error_backtraces v PHP 8.5, ki ne ponastavi stanja sledi pri kon\u010danju. V prvem primeru je napad mogo\u010d na mod_php in PHP-FPM, medtem ko je v drugem primeru mogo\u010d le na mod_php. Omemba je tudi nepotrjene mo\u017enosti izvajanja napada v konfiguracijah, kjer so nastavitve, ki vodijo do prikazovanja opozoril v zgodnji fazi obdelave poizvedbe (na primer opozorila o uporabi zastarelih parametrov).<\/p>\n<\/ul>\n<p>Trdi se, da je popolna blokada ranljivosti mogo\u010da le z namestitvijo posodobitve. Naslednje ukrepe lahko zmanj\u0161ajo verjetnost uspe\u0161nega napada, ne zagotavljajo pa popolne varnosti sistema:<\/p>\n<ul>\n<li class=\"l\"> Nastavitev v php.ini parametra \"memory_limit=-1\", kar ote\u017euje mo\u017enost napadalca za nadzor iz\u010drpavanja omejitev pomnilnika.\n<li class=\"l\"> Nastavitev parametra \"post_max_size=8M\", \u010de ni potrebe po nalaganju velikih datotek. Vrednost parametra \"upload_max_filesize\" mora biti manj\u0161a od parametra \"post_max_size\".\n<li class=\"l\"> Nastavitev omejitve na dovoljeno porabo pomnilnika na ravni sistema, preko cgroup memory.max ali parametrov porabe pomnilnika v kontejnerju, vendar ne preko sistemskih omejitev RLIMIT_AS in RLIMIT_DATA, ki le provokativno izzovejo problemati\u010den klic longjmp().\n<li class=\"l\"> \u010ce zmogljivost ni pomembna, je mo\u017eno omejiti \u0161tevilo poizvedb, ki jih obdeluje en delovni proces preko pm.max_requests=1 v PHP-FPM in MaxRequestsPerChild v Apache httpd.\n<li class=\"l\"> Nastavitev na ravni php.ini ali konfiguracije <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sl\/server\/dts-los-angeles\/\"   title=\"stre\u017enika\" data-wpil-keyword-link=\"linked\">stre\u017enika<\/a> (ne prek ini_set() ali FPM .user.ini, saj mora biti parameter veljaven pred za\u010detkom obdelave zahtevka) parametra \"session.upload_progress.enabled=0.\n<li class=\"l\"> Pri uporabi razli\u010dice PHP 8.5 je treba nastaviti parameter \"fatal_error_backtraces=0\".\n<li class=\"l\"> Odprava stale\u017enih ali napa\u010dnih nastavitev, povezanih z posameznimi poizvedbami (kot so assert.* in napa\u010dne poti v open_basedir), ki vodijo do prikazovanja diagnosti\u010dnih sporo\u010dil pred inicializacijo.\n<li class=\"l\"> Odprava v PHP kodi situacij, ki vodijo do doseganja \u010dasovnih omejitev in usodnih napak, na primer, povezanih s napakami v povratnih obdelovalcih in obdelavi nalaganj.\n<li class=\"l\"> Za blokiranje prve ranjivosti u kodu starih verzija PHP mo\u017ee se zamijeniti poziv longjmp() u handleru za istro\u0161enost slobodne memorije s _exit().\n<li class=\"l\"> Dodatno, mogu\u0107e je smanjiti vrijednost parametra max_input_nesting_level u php.ini i blokirati multipart zahtjeve, kao \u0161to je prikazano u prethodnom najavi.\n<\/ul>\n<p>Status ispravka ranjivosti u distribucijama mo\u017ee se procijeniti na sljede\u0107im stranicama: Debian, Ubuntu, SUSE, RHEL, Gentoo, Arch,<br \/>\nFedora, FreeBSD.<\/p>\n<p>Dopolnilo 1: Ranljivosti so bile razkrite s pomo\u010djo AI modelov GPT-5.6 in Gemini 4 Argon. Podjetje OpenAI je objavilo orodje php2shell-checker za preverjanje ranljivosti spletnih strani in lokalnih izvr\u0161ljivih datotek, vendar to orodje le preverja \u0161tevilko razli\u010dice PHP, ki jo vrne HTTP stre\u017enik ali ukaz \"php -v\", brez podrobne analize.<\/p>\n<p>Dodatek 2: Autor prototipa eksploitera koji koristi ranjivost uzrokovanu dvostrukim osloba\u0111anjem memorije (double-free) izvijestio je da problem ostaje neispravljen u izdanju PHP 8.5.12, a eksploatacija i dalje radi. Ranije su predstavnici PHP-a tvrdili da ova ranjivost nije povezana s planiranim ispravkama i da nije stvarni problem. Autor eksploita tvrdio je da je to potpuno druga\u010dija ranjivost.<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66520\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 PHP 8.5.12, 8.4.27, 8.3.36 \u0438 8.2.35, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u0436\u0435 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PHP 7.4, PHP 8.0 \u0438 PHP 8.1 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 5.4 \u043f\u043e 7.3 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0431\u0435\u0437 \u043f\u0430\u0442\u0447\u0435\u0439), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-109618 &#8212; \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u043d\u0435\u0445\u0432\u0430\u0442\u043a\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183943","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 PHP 8.5.12, 8.4.27, 8.3.36 \u0438 8.2.35, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u0436\u0435 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PHP 7.4, PHP 8.0 \u0438 PHP 8.1 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 5.4 \u043f\u043e 7.3 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0431\u0435\u0437 \u043f\u0430\u0442\u0447\u0435\u0439), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 PHP 8.5.12, 8.4.27, 8.3.36 \u0438 8.2.35, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u0436\u0435 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PHP 7.4, PHP 8.0 \u0438 PHP 8.1 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 5.4 \u043f\u043e 7.3 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0431\u0435\u0437 \u043f\u0430\u0442\u0447\u0435\u0439), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-22T03:40:56+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-22T03:41:02+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Objavljene su pojedinosti o kriti\u010dnim ranjivostima u PHP-u i objavljene su ispravke | ProHoster","description":"Objavljene su ispravne verzije PHP 8.5.12, 8.4.27, 8.3.36 i 8.2.35, kao i zakrpe za ve\u0107 neodr\u017eavane grane PHP 7.4, PHP 8.0 i PHP 8.1 (ranjive verzije od 5.4 do 7.3 ostaju bez zakrpa), u kojima.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 PHP \u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 PHP 8.5.12, 8.4.27, 8.3.36 \u0438 8.2.35, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0443\u0436\u0435 \u043d\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PHP 7.4, PHP 8.0 \u0438 PHP 8.1 (\u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441 5.4 \u043f\u043e 7.3 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0431\u0435\u0437 \u043f\u0430\u0442\u0447\u0435\u0439), \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/details-of-critical-php-vulnerabilities-disclosed-and-security-updates-released","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-22T03:40:56+00:00","article:modified_time":"2026-10-22T03:41:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183943","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=183943"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183943\/revisions"}],"predecessor-version":[{"id":183944,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183943\/revisions\/183944"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=183943"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=183943"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=183943"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}