{"id":24859,"date":"2026-10-22T10:10:51","date_gmt":"2026-10-22T01:10:51","guid":{"rendered":"https:\/\/sparrow.im\/kr\/?post_type=announcement&p=24859"},"modified":"2026-10-23T23:23:08","modified_gmt":"2026-10-23T14:23:08","slug":"php-%eb%b3%b4%ec%95%88-%ec%b7%a8%ec%95%bd%ec%a0%90-%ea%b4%80%eb%a0%a8-%ec%95%88%eb%82%b4cve-2026-109618-cve-2026-109619","status":"publish","type":"announcement","link":"https:\/\/sparrow.im\/kr\/info\/notice\/view\/20261022\/php-%EB%B3%B4%EC%95%88-%EC%B7%A8%EC%95%BD%EC%A0%90-%EA%B4%80%EB%A0%A8-%EC%95%88%EB%82%B4cve-2026-109618-cve-2026-109619\/","title":{"rendered":"PHP \ubcf4\uc548 \ucde8\uc57d\uc810 \uad00\ub828 \uc548\ub0b4(CVE-2026-109618, CVE-2026-109619)"},"content":{"rendered":"
\n

\uc548\ub155\ud558\uc138\uc694, \uc2a4\ud328\ub85c\uc6b0\uc785\ub2c8\ub2e4.<\/p>\n

\ucd5c\uadfc \uc6f9\uc0ac\uc774\ud2b8 \uad6c\ucd95\uc5d0 \ub110\ub9ac \uc4f0\uc774\ub294 \ud504\ub85c\uadf8\ub798\ubc0d \uc5b8\uc5b4 ‘PHP’\uc5d0\uc11c \ubcf4\uc548 \ucde8\uc57d\uc810(CVE-2026-109618, CVE-2026-109619)\uc774 \uacf5\uac1c\ub418\uc5c8\uc2b5\ub2c8\ub2e4.
\n\ud574\ub2f9 \ucde8\uc57d\uc810\uc740 PHP \uae30\ubc18 \uc11c\ubc84 \ubc0f \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ud658\uacbd\uc5d0 \uc2ec\uac01\ud55c \ubcf4\uc548 \uc704\ud611\uc744 \ucd08\ub798\ud560 \uc218 \uc788\uc5b4 \uc601\ud5a5\uc744 \ubc1b\ub294 \ubc84\uc804\uc5d0 \ub300\ud55c \uc2e0\uc18d\ud55c \uc810\uac80\uacfc \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8\uac00 \uad8c\uace0\ub429\ub2c8\ub2e4.<\/p>\n

\uc0ac\uc6a9 \uc911\uc778 PHP \ubc84\uc804\uc774 \uc601\ud5a5 \ubc94\uc704\uc5d0 \ud574\ub2f9\ud558\ub294\uc9c0 \uad81\uae08\ud558\uc2dc\ub2e4\uba74, PHP2Shell \ubb34\ub8cc \uc810\uac80 \ud398\uc774\uc9c0(https:\/\/php2shell.sparrow.im<\/a>)<\/strong>\uc5d0\uc11c \ud655\uc778\ud558\uc2e4 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n

<\/p>\n

\n

\u25a0 \uac1c\uc694<\/h3>\n

\u2013 CVE ID:<\/strong> CVE-2026-109618, CVE-2026-109619
\n\u2013 \uc8fc\uc694 \uc704\ud5d8:<\/strong> \ucde8\uc57d\uc810 \uc545\uc6a9 \uc2dc \uc778\uc99d\ub418\uc9c0 \uc54a\uc740 \uacf5\uaca9\uc790\uc5d0 \uc758\ud55c \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589(RCE) \ubc0f \ubbfc\uac10 \uc815\ubcf4 \uc720\ucd9c \uac00\ub2a5
\n\u2013 \uc601\ud5a5 \uc218\uc900:<\/strong> Critical (CVSS v4.0 9.2, \ub450 \ucde8\uc57d\uc810 \ub3d9\uc77c)
\n\u2013 \uc601\ud5a5\uc744 \ubc1b\ub294 \ubc84\uc804 \ubc0f \ud328\uce58 \ubc84\uc804<\/strong> (\ub450 \ucde8\uc57d\uc810 \ub3d9\uc77c)<\/p>\n

\n\n\n\n\n\n\n\n\n
\uc81c\ud488\uba85<\/th>\n\uc601\ud5a5\uc744 \ubc1b\ub294 \ubc84\uc804<\/th>\n\ud328\uce58 \ubc84\uc804<\/th>\n<\/tr>\n<\/thead>\n
PHP 8.2<\/td>\n8.2.35 \ubbf8\ub9cc<\/td>\n8.2.35 \uc774\uc0c1<\/td>\n<\/tr>\n
PHP 8.3<\/td>\n8.3.36 \ubbf8\ub9cc<\/td>\n8.3.36 \uc774\uc0c1<\/td>\n<\/tr>\n
PHP 8.4<\/td>\n8.4.27 \ubbf8\ub9cc<\/td>\n8.4.27 \uc774\uc0c1<\/td>\n<\/tr>\n
PHP 8.5<\/td>\n8.5.12 \ubbf8\ub9cc<\/td>\n8.5.12 \uc774\uc0c1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

\u203b PHP 8.1 \uc774\ud558 \ubc84\uc804\uc740 \uacf5\uc2dd \ubcf4\uc548 \uc9c0\uc6d0\uc774 \uc885\ub8cc\ub418\uc5b4 \uc9c0\uc6d0 \uc911\uc778 \ubc84\uc804\uc73c\ub85c \uc5c5\uadf8\ub808\uc774\ub4dc\ub97c \uad8c\uace0\ud569\ub2c8\ub2e4. (* \ucc38\uace0 \uc0ac\uc774\ud2b8: KISA \u2013 PHP \uc81c\ud488 \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8 \uad8c\uace0<\/a><\/span>)<\/p>\n<\/div>\n

\u25a0 \uc870\uce58 \ubc29\uc548<\/h3>\n

\u2013 \uc6b4\uc601 \ud658\uacbd \uc810\uac80<\/strong>
\n: PHP \uc124\uce58 \uc5ec\ubd80 \ubc0f \uc0ac\uc6a9 \ubc84\uc804 \ud655\uc778, \ucde8\uc57d \ubc84\uc804 \uc0ac\uc6a9 \uc5ec\ubd80 \uc810\uac80<\/p>\n

\u2013 \ubcf4\uc548 \ud328\uce58 \uc5c5\ub370\uc774\ud2b8(*\uc0c1\uae30 \ud45c \ucc38\uace0)<\/strong>
\n: PHP 8.2, 8.3, 8.4, 8.5\ub294 \uac01 \ubc84\uc804\uc5d0 \ud574\ub2f9\ud558\ub294 \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8 \uc801\uc6a9
\n: PHP 8.1 \uc774\ud558 \ubc84\uc804\uc740 \uc9c0\uc6d0 \uc911\uc778 \ubc84\uc804\uc73c\ub85c \uc5c5\uadf8\ub808\uc774\ub4dc \uad8c\uace0<\/p>\n

 <\/p>\n

<\/p>\n

\ubcf8 \ucde8\uc57d\uc810\uc744 \uc774\uc6a9\ud558\uba74 \uc678\ubd80\uc5d0\uc11c \ubcf5\uc7a1\ud55c \uc870\uac74 \uc5c6\uc774 \uc11c\ubc84\uc5d0\uc11c \uc784\uc758\uc758 \uba85\ub839\uc744 \uc2e4\ud589\ud558\ub294 \uacf5\uaca9\uc774 \uac00\ub2a5\ud558\ubbc0\ub85c, \uc2e0\uc18d\ud55c \ud658\uacbd \uc810\uac80\uacfc \ud328\uce58 \uc801\uc6a9\uc774 \ud544\uc218\uc801\uc785\ub2c8\ub2e4.<\/p>\n

\uc624\ud508\uc18c\uc2a4 \ubd84\uc11d \ubc0f \uad00\ub9ac \ub3c4\uad6c\uc778 Sparrow SCA\ub294 \uc989\uac01\uc801\uc778 \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8\uac00 \uad8c\uace0\ub41c PHP \ucde8\uc57d\uc810(CVE-2026-109618, CVE-2026-109619)\uc744 \uc790\ub3d9 \ud0d0\uc9c0\ud569\ub2c8\ub2e4.<\/p>\n

\uc2a4\ud328\ub85c\uc6b0 \uc81c\ud488\uc740 \uc774\ubc88 \ucde8\uc57d\uc810\uc758 \uc601\ud5a5\uc744 \ubc1b\ub294 PHP \ubc84\uc804\uc744 \uc0ac\uc6a9\ud558\uc9c0 \uc54a\uc74c\uc744 \uc548\ub0b4\ub4dc\ub9bd\ub2c8\ub2e4. \ub530\ub77c\uc11c \ubcc4\ub3c4\uc758 \uc81c\ud488 \ud328\uce58\ub098 \uc5c5\ub370\uc774\ud2b8 \uc870\uce58\ub294 \ud544\uc694\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4. \uad81\uae08\ud558\uc2e0 \uc810\uc740 \uc5b8\uc81c\ub4e0\uc9c0 \uace0\uac1d\uc13c\ud130\ub85c \ubb38\uc758\ud574 \uc8fc\uc2dc\uae30 \ubc14\ub78d\ub2c8\ub2e4.<\/p>\n

(\ubb38\uc758) \uae30\uc220\/\uc7a5\uc560 02-6263-7411<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\uc548\ub155\ud558\uc138\uc694, \uc2a4\ud328\ub85c\uc6b0\uc785\ub2c8\ub2e4. \ucd5c\uadfc \uc6f9\uc0ac\uc774\ud2b8 \uad6c\ucd95\uc5d0 \ub110\ub9ac \uc4f0\uc774\ub294 \ud504\ub85c\uadf8\ub798\ubc0d \uc5b8\uc5b4 ‘PHP’\uc5d0\uc11c \ubcf4\uc548 \ucde8\uc57d\uc810(CVE-2026-109618, CVE-2026-109619)\uc774 \uacf5\uac1c\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \ud574\ub2f9 \ucde8\uc57d\uc810\uc740 PHP \uae30\ubc18 \uc11c\ubc84 \ubc0f \uc560\ud50c\ub9ac\ucf00\uc774\uc158 \ud658\uacbd\uc5d0 \uc2ec\uac01\ud55c \ubcf4\uc548 \uc704\ud611\uc744 \ucd08\ub798\ud560 \uc218 \uc788\uc5b4 \uc601\ud5a5\uc744 \ubc1b\ub294 \ubc84\uc804\uc5d0 \ub300\ud55c \uc2e0\uc18d\ud55c \uc810\uac80\uacfc \ubcf4\uc548 \uc5c5\ub370\uc774\ud2b8\uac00 \uad8c\uace0\ub429\ub2c8\ub2e4. \uc0ac\uc6a9 \uc911\uc778 PHP \ubc84\uc804\uc774 \uc601\ud5a5 \ubc94\uc704\uc5d0 \ud574\ub2f9\ud558\ub294\uc9c0 \uad81\uae08\ud558\uc2dc\ub2e4\uba74, PHP2Shell \ubb34\ub8cc \uc810\uac80 \ud398\uc774\uc9c0(https:\/\/php2shell.sparrow.im)\uc5d0\uc11c \ud655\uc778\ud558\uc2e4 \uc218 \uc788\uc2b5\ub2c8\ub2e4. \u25a0 \uac1c\uc694 \u2013 […]<\/p>\n","protected":false},"featured_media":0,"template":"","class_list":["post-24859","announcement","type-announcement","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/announcement\/24859","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/types\/announcement"}],"wp:attachment":[{"href":"https:\/\/sparrow.im\/kr\/wp-json\/wp\/v2\/media?parent=24859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}