Critical PHP Vulnerabilities

• •Two critical vulnerabilities in PHP disclosed on 2026-10-21, CVSS 9.2.
• •CVE-2026-109618 has a public proof-of-concept demonstrating exploitation.
• •Active exploitation of these vulnerabilities has been confirmed.

Two critical vulnerabilities in PHP's session.upload_progress handler have been disclosed, with CVE-2026-109618 and CVE-2026-109619 both published on 2026-10-21, each rated CVSS 9.2. The vulnerabilities allow for an use-after-free condition that can lead to remote code execution under specific circumstances. The first public proof-of-concept (PoC) for CVE-2026-109618 is also available, demonstrating the exploit's capabilities. Affected systems include PHP versions 5.4 and later, particularly those using session.upload_progress without proper configuration. The vulnerabilities have been reported as actively. Security professionals are urged to apply patches immediately and monitor for unusual activity related to PHP sessions.