PHP Releases Emergency Patches for Two Critical Unauthenticated RCE Vulnerabilities
Summary
PHP released patches for CVE-2026-109618 and CVE-2026-109619, critical flaws involving multipart requests and session upload progress. The vulnerabilities can enable unauthenticated remote code execution; the reported PHP2Shell demo was not independently verified.
Key points
- Both vulnerabilities are rated 9.2 CVSS and affect PHP versions 5 through 8; PHP advisories confirmed the reported vulnerability details.
- The flaws involve multipart/form-data handling alongside PHP's session.upload_progress mechanism and are described as use-after-free and memory corruption.
- An attacker with network access to a PHP application could reportedly execute code as the PHP process without authentication.
- PHP released patches on October 21, including backported fixes for PHP 7.4, 8.0, and 8.1; administrators are advised to update.
- Before patching, the article recommends disabling upload progress, blocking multipart requests, considering temporary isolation of internet-connected PHP applications, and preparing to install updates promptly.
- A leaked demo showed the exploit against several web platforms, but its authenticity and exact behavior had not been independently verified.
Article Details
- Vulnerability Types
- Use-after-free
- Memory corruption
- Severity
- Critical; both vulnerabilities rated 9.2 on the CVSS scale.
- Affected Versions
- PHP 5.x
- PHP 6.x
- PHP 7.x
- PHP 8.x
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Disable upload progress by setting session.upload_progress.enabled = Off using php_admin_flag in PHP-FPM pools.
- Block multipart requests on nginx and Apache servers.
- Temporarily isolate PHP applications that connect to the Internet.
MITRE ATT&CK
CVE
Vendors
Products
Kaspersky Anti Targeted AttackExploitation of the PHP2Shell vulnerability in network traffic is detected by Kaspersky Anti Targeted Attack (KATA).Kaspersky Endpoint Detection and ResponseWhen an attempt is made to exploit these RCE vulnerabilities, Kaspersky Endpoint Detection and Response promptly alerts the user to suspicious actions performed in the context of a web server, on both Linux and WindowsKaspersky NextOur Kaspersky Endpoint Security solution, now available as Kaspersky Next, also detects malicious post-exploitation activity using the Behavior Detection component, such as PDM:Exploit.Linux.Generic andPHPOn October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale).