Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 14:00 UTC
Critical PHP security vulnerabilities (CVE-2026-109618, CVE-2026-109619): updates in progress
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical vulnerabilities (CVSS 9.2) that allow unauthenticated remote code execution:
- CVE-2026-109618: memory corruption when PHP runs out of memory while handling specially crafted multipart (form or upload) requests.
- CVE-2026-109619: internal data left over from an earlier request can be reused after its memory is freed, for example through session upload progress handling.
Apache mod_php carries the highest risk. PHP-FPM, LiteSpeed and FrankenPHP are affected in some configurations.
- CloudLinux alt-php: We are preparing patched builds for all alt-php versions, from 5.2 through 8.5. We expect to release them within approximately 5 hours. We will update this page when they are available.
- cPanel ea-php: Patched ea-php74 through ea-php85 packages are scheduled for release in EasyApache4 v25.91.
- TuxCare ELS: Patched PHP packages for supported ELS operating systems are in testing and will be released as they complete validation.
- Imunify360: WAF rules that detect attempts to exploit these vulnerabilities have been deployed.
- Apply PHP updates as soon as they are available (yum update / apt upgrade) and restart your PHP services: Apache, PHP-FPM or LSAPI.
- Until then, you can reduce (but not remove) the risk by setting session.upload_progress.enabled=0 in php.ini or the FPM pool configuration, then restarting PHP.
We will post updates here as packages are published.
The releases for alt-php are already in progress. The ea-php is also proceeding to release soon
We plan to release fixes for alt-php and ea-php by 19:00 UTC. Maximum effort is currently being made to get this done sooner.
alt-php74 is already released for EL6 and EL10
The Imunify360 ModSecurity ruleset 8.83 is now in the Stable channel. It contains a blocking rule for the publicly circulating exploit shape for CVE-2026-109618 / CVE-2026-109619, which targets the PHP session upload progress handling of multipart requests, plus a telemetry rule to track related activity. Servers with Imunify360 and its WAF (ModSecurity) enabled receive the ruleset automatically, no action is needed. Attempts matching this pattern are already being observed, and additional heuristic rules are being prepared.
This is an interim mitigation, not a complete fix: the underlying issue is broader than the multipart upload path. The PHP security release is still scheduled for today, 21 October 2026, 14:00 UTC. Work on updated alt-php packages with the fix is in progress, we will the timeline in the update.
Optional partial hardening until the patch is applied: disabling the session upload progress feature in php.ini (session.upload_progress.enabled = Off). This closes only one of the known paths and does not fully mitigate the vulnerability. Applications that display upload progress bars via this feature will lose that functionality.
The PHP Security Team has announced an upcoming security release scheduled for
It addresses two critical vulnerabilities, publicly reported as
Technical details and affected versions are scheduled to be disclosed at that time.
We will post updates here as more information becomes available.
This incident affects: CloudLinux OS Components (Alt-PHP).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
