CVE Central: investigation report

The narrated browser demonstration follows a fresh Parcel Desk investigation, run 20261022T041953Z-70ce5a, through CVE confirmation, target inspection, assessment, a manual change plan and report creation. Both CVE-2026-109618 and CVE-2026-109619 affect the observed PHP 8.4.26 runtime; all six normal application checks passed. The proposed patch is PHP 8.4.27. No runtime update or exploit test was performed.

Read the final report shown in the video · Complete recorded investigation · File hashes.

The earlier investigation below remains available as a separate evidence record.

Run 20261022T024516Z-0741ba examined the synthetic Parcel Desk lab for CVE-2026-109618 and CVE-2026-109619. It started at 02:45:19 UTC and finished at 02:46:14 UTC on October 22, 2026. The operator advanced the case through scan, assessment, planning and report phases using the API, reviewing the evidence between phases.

The supported target is an upstream PHP/Apache application managed with Docker Compose. This is a completed planning investigation. No runtime upgrade, exploit attempt or post-change verification occurred.

Checks covered the home page, quote calculation, session continuity, upload page, normal multipart upload and session upload count. Three units returned a total of 36. These are baseline behavior checks, not exploit probes. Docker port bindings were recorded; external reachability was not inferred.

Both CVEs were classified as affecting the observed PHP 8.4.26 runtime. Both identify 8.4.27 as the patch boundary in this branch. The worker fetched the PHP CNA records at 02:45:21 UTC, without cache hits. The classifier compared supported structured ranges; the model did not invent the patch version.

• CVE-2026-109618: upstream advisory
• CVE-2026-109619: upstream advisory

The finding establishes affected-version applicability. Memory corruption was not observed. The interrupted-request producer/consumer sequence was not reproduced. Functional upload success cannot establish exploitation or exclude it.

Replace php:8.4.26-apache with php:8.4.27-apache for the configured web service. The generated procedure requires reconfirming current evidence, arranging application/data recovery, pulling and recording the new image, saving Compose configuration, reviewing the guarded edit and recreating the service in an approved window.

Completion requires the intended version observed through HTTP, all six baseline checks repeated successfully, application fingerprints compared and the replacement container recorded. None of these post-change outcomes has been measured. Reverting to an affected image reintroduces the findings; the recovery decision must retain that fact.

Open the generated manual procedure (English). It records the lab paths and commands as captured. Revalidate the target and fresh advisory evidence before executing it.

The service recorded seven Gemini 3.5 Flash-Lite calls, 21,738 input tokens and 326 output tokens. The approximately 55-second start-to-finish interval includes review pauses. The worker separately accumulated 6.97 seconds of active phase time. These figures are one observation, not a benchmark, invoice or predicted upgrade duration.

The downloaded event chain was recomputed and verified. Hash linking supports detection of changed evidence, but the chain has no independent signature or external immutable anchor. It is not proof against a party capable of rewriting the whole record.

Download the complete run JSON · File hashes and scope. The files contain synthetic lab deployment details. The source evidence remains in English.

The observed runtime needs a planned update for both selected findings even though every normal application check passed. One same-branch image replacement is proposed. The next measurement is the outcome of that approved change and the repeated acceptance checks.

To evaluate broader reliability, repeat across affected, already-patched and unsupported targets, retain unresolved cases and failed runs, and compare outcomes with independent review. This single successful investigation cannot supply that denominator. The target-local worker has Docker access and belongs on a trusted lab host.

Read the article for the narrative and the Agent page for the project overview.