As reported by SecurityAffairs, PHP is releasing emergency security updates today for two critical remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — both rated CVSS v4.0 9.2. The flaws reside in PHP's session.upload_progress handler (php_session_rfc1867_callback, ext/session/session.c) and involve heap use-after-free primitives. A researcher publicly claimed to have reproduced the vulnerabilities in a lab environment, and watchTowr independently confirmed one flaw, prompting PHP to accelerate its release timeline.
This is a high-urgency event. The vulnerability class — heap use-after-free in session handling — is well-understood by exploit developers and historically yields reliable RCE primitives. The fact that PoC information has already circulated on social media, even without full technical disclosure, means adversary reproduction is likely a matter of hours, not days.
Vulnerability Summary
| CVE | CVSS v4.0 | Type | Component | Patch Status | Active Exploitation |
|---|---|---|---|---|---|
| CVE-2026-109618 | 9.2 (Critical) | Heap Use-After-Free → RCE | session.upload_progress handler | Emergency fix releasing Oct 21, 2026 14:00 UTC | PoC reproduced; no confirmed in-the-wild exploitation yet |
| CVE-2026-109619 | 9.2 (Critical) | Heap Use-After-Free → RCE | session.upload_progress handler | Emergency fix releasing Oct 21, 2026 14:00 UTC | PoC claimed; no confirmed in-the-wild exploitation yet |
Affected Versions
PHP has not yet published the full list of affected versions, but early reporting suggests the flaws may impact versions dating back to PHP 5. If confirmed, this is significant: PHP 5.x and PHP 7.x have been end-of-life for years, yet remain widely deployed in legacy hosting environments, content management systems, and internal applications. Any unsupported PHP version receiving this fix would be extraordinary — meaning organizations on EOL branches are likely on their own.
Why This Matters
PHP powers roughly 75% of all web servers globally. The session.upload_progress feature is enabled by default in many configurations and is commonly used for file upload tracking in web applications. Unlike niche vulnerabilities that require specific plugin configurations, these flaws potentially affect the core runtime of millions of servers.
The combination of default-enabled functionality, heap corruption primitives, and leaked exploitation details creates a near-certain window of zero-day exposure between patch availability and organizational deployment.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Patch now. As soon as the fixed PHP release is available at 14:00 UTC, prioritize upgrading all internet-facing PHP servers. Treat this as a P0 change request — bypass normal maintenance windows.
- Inventory PHP versions. Use asset discovery tools to identify every server running PHP, including containers and embedded appliances. You cannot patch what you don't know exists.
- Disable session.upload_progress if patching is delayed. Set
session.upload_progress.enabled = 0inphp.inias an interim mitigation. Assess application impact first — file upload progress bars will stop functioning. - Deploy WAF rules. If your WAF vendor has not yet released signatures, create a temporary rule to restrict or monitor requests involving
session.upload_progressmultipart form data patterns. - Monitor for exploitation. Look for anomalous POST requests with
session.upload_progress.nameparameters, unexpected child process spawns from PHP-FPM workers, and suspicious outbound connections from web server hosts. - Plan EOL migration. If you are running PHP 5.x or 7.x, this is your wake-up call. No emergency patch will save unsupported branches indefinitely. Prioritize upgrade roadmaps now.
Detection Guidance
Until specific technical details are published, defenders should focus on behavioral indicators: anomalous PHP-FPM worker memory usage, unexpected file creation in web-accessible directories, and command-line execution originating from PHP processes. EDR rules correlating PHP-FPM process ancestry with suspicious child processes (sh, bash, python, curl) will catch post-exploitation activity even if initial exploitation goes undetected.
The window between patch availability and universal deployment is where breaches happen. Organizations that have pre-staged their patching process — build pipelines tested, maintenance windows pre-approved, rollback plans ready — will close this gap. Those that haven't will be reading about themselves in incident reports next week.
