Skip to content
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed

Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Disclosed

First seen 21 Oct 2026, 17:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 17:41 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities with CVSS 9.2.
  • •They allow remote code execution via a use-after-free flaw in PHP's session handling.
  • •Affected PHP versions include 8.2.35, 8.3.36, 8.4.27, and 8.5.12; earlier versions are unsupported.

On October 21, 2026, PHP announced a security release addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both with a CVSS score of 9.2. These vulnerabilities are associated with a use-after-free flaw in the `session.upload_progress` handler, which can lead to remote code execution (RCE) without authentication. The vulnerabilities affect PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, while earlier versions are end-of-life and will not receive fixes. Researchers suggest that disabling the `upload_progress` feature may mitigate one of the attack vectors, but not both. The PHP team has not confirmed the exact component responsible for the vulnerabilities, which were revealed through leaks and research analysis. Users are advised to maintain mitigations until official patches are applied and PHP-FPM or LSAPI is restarted.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-06-04
CVE-2026-10961 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
PHP security release announced
PHP disclosed critical vulnerabilities CVE-2026-109618 and CVE-2026-109619, advising users to apply mitigations until patches are available.
Sploitus
2026-10-21
First public PoC released
The first proof-of-concept for CVE-2026-109618 was made public, increasing the urgency for users to mitigate the vulnerabilities.
Sploitus
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (3)

Following this threat?

Track CloudLinux and CVE-2026-10961 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 3

Common questions

Which PHP versions are affected?
The vulnerabilities affect PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12; earlier versions are end-of-life.
What mitigation steps should I take?
Disable the `upload_progress` feature as a temporary measure until patches are released and applied.
Is there a proof-of-concept available?
Yes, the first public proof-of-concept for CVE-2026-109618 was released on October 21, 2026.