Karen IT Security Response Center (KSRC) Advisory

Publication Date: 21 October 2026

Critical Remote Code Execution Vulnerabilities in PHP Core
CVE-2026-109618 & CVE-2026-109619

Summary

The PHP project has announced an emergency security release scheduled for 21 October 2026 at 14:00 UTC addressing two critical vulnerabilities in the PHP core. Both vulnerabilities have been assigned a CVSS v4.0 score of 9.2 (Critical).

These flaws, currently tracked as CVE-2026-109618 and CVE-2026-109619 (also referred to in the security community as “PHP2Shell”), are capable of allowing unauthenticated remote code execution. Information regarding the vulnerabilities leaked prior to the coordinated disclosure window, significantly increasing the likelihood of rapid exploitation once technical details and patches become publicly available.

Multiple independent security research groups have confirmed the validity of the issues. Widespread scanning and mass exploitation attempts are expected shortly after the official release.

Technical Overview

While full technical details remain under embargo until the official PHP security release, available information and independent analysis indicate that the vulnerabilities reside in the handling of multipart form data related to the session upload progress mechanism (session.upload_progress).

Key characteristics reported by researchers include:

• The vulnerable code path is reachable on default configurations.
• Exploitation does not require authentication.
• The issues affect a broad range of PHP versions (reports indicate impact dating back to PHP 5.4).
• Successful exploitation can result in arbitrary code execution with the privileges of the PHP process (typically the web server user).

Only currently supported PHP branches (8.2 and later) are expected to receive official patches. End-of-life versions (PHP 8.1 and earlier) will remain unpatched by the upstream project.

Impact

Any internet-facing system running a vulnerable version of PHP is potentially at risk of full compromise. Successful exploitation may lead to:

• Remote code execution
• Complete server takeover
• Data exfiltration
• Lateral movement within the environment
• Deployment of web shells or secondary payloads

Organizations operating WordPress, Drupal, Joomla, Magento, Laravel, custom PHP applications, or any other PHP-based service should treat this as a high-priority incident.

Recommendations

Immediate Actions:

1. Inventory all systems running PHP, including version and SAPI (mod_php, PHP-FPM, etc.).
2. Prepare emergency maintenance windows for rapid patching.
3. Apply the official security updates as soon as they are released by the PHP project.
4. Temporary mitigation (until patches are applied): Disable the session upload progress feature by setting session.upload_progress.enabled = Off in the relevant php.ini or pool configuration, then reload PHP-FPM / restart the web server. Note: This is a temporary measure only and does not constitute a complete remediation.
5. For systems running end-of-life PHP versions, prioritize upgrading to a supported branch or isolate the systems from public networks until remediation is possible.

Monitor the official PHP announcement channels for the exact fixed version numbers and full technical details.

Karen IT
We make the Internet harder to abuse.