Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]
PoC publicPHPUbuntuOur summary
PHP.net has shipped an emergency fix for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4, after SANS ISC raised its InfoCon to yellow due to public PoC code and confirmed in-the-wild exploitation reported by Cloudflare. Essentially every PHP release back to version 5 is affected, but only PHP 8 is getting fixed, with safe builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35 published on October 20-21, 2026 and Ubuntu already issuing updated packages for several supported releases. CVE-2026-109618 is a memory-corruption remote-code-execution bug tied to malformed multipart uploads that bypass size and header limits, while CVE-2026-109619 is a use-after-free caused by improper reset of per-request global state such as sessions. Until patches are fully deployed, admins are advised to disable session.upload_progress, cap request sizes, and consider blocking multipart/form-data uploads as temporary mitigations.
Below is the opening; the full story is at SANS Internet Storm Center.
From SANS Internet Storm Center
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available.
The PHP update was released as schedule: https://www.php.net/index.php#2026-10-20-1…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.