Imunify360 Ruleset 8.83 Blocks the Public Exploit Shape

📋 TL;DR — Interim update, 21 October 2026. The upstream PHP fix is not out yet. We’ll update this post as updates land.

The PHP security team announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS v4.0 9.2), ahead of a release scheduled for 21 October 2026 at 14:00 UTC.

The PHP security team announced two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (both CVSS v4.0 9.2), ahead of a release scheduled for 21 October 2026 at 14:00 UTC.

Public research ties one of the flaws to PHP’s session upload progress handling of multipart requests. PHP has not confirmed this.

Public research ties one of the flaws to PHP’s session upload progress handling of multipart requests. PHP has not confirmed this.

Imunify360 ModSecurity ruleset 8.83 blocks the publicly circulating exploit shape for these CVEs on Apache. On LiteSpeed it logs the pattern but does not block. It is in Stable and rolling out now. Servers with Imunify360 and its WAF enabled receive it automatically.

Imunify360 ModSecurity ruleset 8.83 blocks the publicly circulating exploit shape for these CVEs on Apache. On LiteSpeed it logs the pattern but does not block. It is in Stable and rolling out now. Servers with Imunify360 and its WAF enabled receive it automatically.

This is an interim mitigation, not a fix. The permanent fix is the upstream PHP release. Updating PHP is still action number one.

This is an interim mitigation, not a fix. The permanent fix is the upstream PHP release. Updating PHP is still action number one.

Updated alt-php and ea-php packages will follow right after the upstream release. Follow the status page incident for updates.

Updated alt-php and ea-php packages will follow right after the upstream release. Follow the status page incident for updates.

On 20 October, the PHP security team announced that a security release is coming for two vulnerabilities, both rated Critical at CVSS v4.0 9.2.

The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC . The team also reserved the right to release earlier if details become public or if exploitation is seen in the wild.

Technical details from the PHP team are due with the release. Imunify’s WAF rules changelog classifies the issue as remote code execution in PHP core, and CERT-EU has published an advisory.

What we can add comes from public research, not from PHP. Two separate CVEs mean at least two attack vectors. Researchers tie one of them to the session upload progress feature, which tracks file-upload progress inside a session. Imunify analysts believe the underlying problem is broader than that one path. PHP has not confirmed any of this, and the list of affected versions will come from PHP with the release.

What Imunify360 does today

Imunify360 uses ModSecurity, the open-source web application firewall (WAF) engine, with rules maintained by Imunify’s analysts.

Ruleset 8.83 is a regular WAF release that also carries rules for other vulnerabilities. For these CVEs it adds two rules. On Apache, one rule blocks the publicly circulating exploit shape. On LiteSpeed, the matching rule only logs. Both give analysts telemetry to see how the attack evolves and adjust coverage. Further rule updates are in preparation.

This is a virtual patch: it stops the known request pattern at the server edge, while the vulnerable PHP code stays as it is. A request that differs from that pattern may not match, and the rule covers one attack path, not both CVEs in full. That is why we call it interim. It is a stopgap.

Update PHP as soon as the patched release is available for your branch. Upstream fixes are expected for the 8.2 to 8.5 branches, and PHP will publish the full list of affected and fixed versions with the release. If you run an older branch, check with your PHP provider for updated packages.

Check that ruleset 8.83 has reached your servers. On Imunify360 hosts with the WAF enabled, it arrives without any action. To confirm, read the ruleset VERSION file as root. On cPanel with Apache, for example:

Paths for Plesk, DirectAdmin, standalone servers, and LiteSpeed are in the Imunify360 ruleset version article . The release notes are in the Imunify WAF rules changelog . If the version is older than 8.83, update the ruleset and check again:

If you run CloudLinux alt-php, follow the status page incident and apply the updated packages when they ship.

On Debian and Ubuntu, use apt-get upgrade . For ea-php on cPanel EA4, update through cPanel once the packages are synced.

There is no confirmed PHP-side workaround yet. Suggestions circulating online, such as turning off session upload progress in php.ini, are unconfirmed, and at least one report says they do not work. We are not recommending them as a mitigation.

Where immediate patching is not possible, CERT-EU’s advisory also suggests isolating internet-facing PHP applications from public networks until a fix is applied.

We will publish the update after the upstream release, including the timeline for CloudLinux PHP packages.

Why it matters on a hosting server

PHP runs WordPress, WooCommerce, Magento, Drupal, Joomla and most of the rest of the shared-hosting stack, on servers that face the internet.

An unauthenticated remote code execution flaw needs no account on the target site: the attacker only has to reach a PHP endpoint. Sansec expects mass exploitation to follow the upstream release. Huntress and watchTowr reported no exploitation as of the morning of 21 October, and no proof of concept is public. A screenshot of an exploit tool has circulated, with no code.