어제 오늘 이 문제로 시끄럽습니다.
메모리 관련 취약점이라고는 하는데, 제 이해력이 딸려서 정확히 어떤 문제인지는 잘 모르겠군요..
여튼 느긋? 불안?하게 데비안 업데이트를 기다리고 있으나,
오늘 핫픽스가 릴리스되었음에도 아직 데비안 12 저장소에는 업데이트가 올라오지 않았습니다.
그래서 아쉬운대로 뉴스 아카이브에서 제시하는 임시방편을 적용해야겠습니다.
If you cannot update immediately: while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.
RCE via OOM corruption (CVE-2026-109618):
Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.
Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.
Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.
RCE via stale global state (CVE-2026-109619):
Set session.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants.
On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only.
Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors or @ does not help.
Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.
The advisories linked above have the full technical details.
- memory_limit=-1 : FPM 풀이나 Apache 설정에서 php_admin_value로 설정해서, 애플리케이션 레벨에서 이 값을 임의로 변경하지 못하게 하라고 합니다.
- post_max_size : 가능한 낮게 설정하라고 합니다. 파일 업로드가 필요 없는 애플리케이션이면 8M, 필요하면 32M으로 설정하라는군요. upload_max_filesize도 post_max_size보다 낮게 설정하는걸 잊지 말라고 합니다.
- session.upload_progress.enabled=0 : php.ini또는 FPM 풀에서 직접 수정한 뒤 모든 워커를 재시작하라고 합니다. ini_set()이나 .user.ini는 사용하지 말라고 하는군요.
