Skip to content
RCE Vulnerabilities in PHP Session Handling Exploited

RCE Vulnerabilities in PHP Session Handling Exploited

First seen 23 Oct 2026, 14:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 16:43 UTC
  • •CVE-2026-109618 and CVE-2026-109619 are critical RCE vulnerabilities in PHP.
  • •Public PoCs are available, and active exploitation has been confirmed.
  • •Affected systems include PHP versions below 8.3.36; immediate patching is recommended.

Two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, affecting PHP versions below 8.3.36. The vulnerabilities arise from improper handling of session upload progress, allowing attackers to exploit memory corruption and stale session data. Proof-of-concept (PoC) exploits have been made publicly available, with confirmed shortly after their release. Tools such as 'php2shell' and 'check-CVE-2026-109619.py' are designed to exploit these vulnerabilities, enabling unauthorized remote code execution. Security professionals are urged to assess their PHP installations and apply necessary patches. The vulnerabilities are, with a CVSS score of 9.2, indicating a severe risk to systems using affected PHP versions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
CVE-2026-110447 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 and CVE-2026-109619 published
Two critical RCE vulnerabilities in PHP were disclosed, affecting versions below 8.3.36.
Sploitus
2026-10-23
First public PoC released
PoC exploits for the vulnerabilities were made public, enabling potential exploitation.
Sploitus

More articles in this cluster (6)

Following this threat?

Track Debian and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 2

Common questions

Which PHP versions are affected?
PHP versions below 8.3.36 are vulnerable to these critical RCE flaws.
Is there confirmed exploitation in the wild?
Yes, active exploitation has been confirmed shortly after the vulnerabilities were disclosed.
What should I do to protect my systems?
Immediately patch your PHP installations to versions 8.3.36 or later to mitigate these vulnerabilities.