Sploitus Critical RCE Vulnerability in PHP 8.4.26 Exploited via Session Handling Flaw
Article Content
- •CVE-2026-109619 allows RCE in PHP 8.4.26 via session handling flaws.
- •Patches are available in PHP versions 8.4.27 and earlier releases.
- •Exploitation can occur without triggering session_start(), increasing risk.
A critical remote code execution vulnerability (CVE-2026-109619) was discovered in PHP 8.4.26, affecting systems using Apache prefork/mod_php. The flaw arises from improperly controlled sequential memory allocation during session handling, allowing attackers to execute arbitrary code as the `www-data` user. The first public proof-of-concept was released on October 21, 2026, with another related CVE (CVE-2026-109618) published shortly after on October 23. PHP versions 8.4.27, 8.2.35, 8.3.36, and 8.5.12 have been patched to address this vulnerability. Attackers can exploit the flaw by leveraging the `session.upload_progress` feature without triggering `session_start()`. The vulnerability has a CVSS score of 9.2, indicating a critical severity level. Security professionals are urged to update their PHP installations immediately to mitigate the risk of exploitation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which PHP versions are affected?
Is there a public exploit available?
What should I do to protect my systems?
Continue Reading
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like… Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both…