Skip to content
Critical RCE Vulnerabilities Discovered in PHP Affecting Multiple Versions

Critical RCE Vulnerabilities Discovered in PHP Affecting Multiple Versions

First seen 26 Oct 2026, 03:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 05:11 UTC
  • •Two critical RCE vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated command execution.
  • •Affected versions include PHP 8.4.4 and earlier, with default settings enabling the exploit.
  • •Proof-of-concept code has been publicly available since October 21, 2026.

Two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been identified in PHP, specifically exploiting the `session.upload_progress` mechanism. These vulnerabilities allow attackers to execute arbitrary commands on affected web servers without authentication. The affected versions include PHP 8.4.4 and earlier, with the default configuration enabling the exploit. The vulnerabilities were disclosed on October 21, 2026, and proof-of-concept code was released shortly after. Security professionals are urged to apply mitigations and monitor for exploitation attempts, as the vulnerabilities have a CVSS score of 9.2, indicating a critical severity level. Immediate action is recommended to prevent potential breaches.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-22
Public exploit for CVE-2026-96889 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-21
CVE-2026-109619 published
Critical RCE vulnerability disclosed, impacting PHP's session.upload_progress functionality.
Sploitus
2026-10-21
CVE-2026-109618 published
Second critical RCE vulnerability disclosed, also affecting PHP session handling.
Sploitus
2026-10-22
CVE-2026-111497 published
Another critical vulnerability in PHP disclosed, further compounding security concerns.
Sploitus
2026-10-23
First public PoC for CVE-2026-109618
Proof-of-concept code for the vulnerability was released, increasing the risk of exploitation.
Sploitus

More articles in this cluster (5)

Following this threat?

Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 4

Common questions

Which versions of PHP are affected?
PHP 8.4.4 and earlier versions are affected by these vulnerabilities.
Is there proof-of-concept code available?
Yes, proof-of-concept code for CVE-2026-109618 was released on October 23, 2026.
What should be done to mitigate these vulnerabilities?
Security professionals should apply available patches and consider disabling the `session.upload_progress` feature if not needed.