Critical RCE Vulnerabilities in PHP (CVE‑2026‑109618, CVE‑2026‑109619) Impact Web‑Facing Applications
What It Is – Two remote‑code‑execution flaws (use‑after‑free and memory‑corruption) were disclosed in PHP’s handling of multipart/form-data together with the session.upload_progress feature. Both CVEs carry a CVSS 9.2 score.
Exploitability – Public PoC (“PHP2Shell”) demonstrates unauthenticated code execution; exploitation can begin within minutes of disclosure.
Affected Products – PHP core versions 5, 6, 7, 8 (including back‑ported patches for 7.4, 8.0, 8.1). The flaw surfaces in any web stack that runs PHP (WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, WHMCS, etc.).
Why It Matters for Trust & Control Assurance
- Continuous Patch Visibility – Demonstrates the need for real‑time inventory and evidence that all PHP runtimes are patched, a control that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Configuration Hardening – Disabling
session.upload_progressand blocking multipart requests are low‑effort mitigations that can be captured as audit evidence of “secure configuration” controls. - Defensible Incident Readiness – Rapid detection of unpatched PHP instances and documented remediation steps provide a defensible audit trail for regulators and enterprise buyers demanding proof of due diligence.
Recommended Actions
- Run an automated inventory of every PHP‑enabled server, container, and SaaS endpoint.
- Immediately disable
session.upload_progress(session.upload_progress.enabled = Off) via PHP‑FPM or php.ini. - Block multipart/form‑data requests at the web‑server layer (nginx/Apache) until patches are applied.
- Apply the emergency PHP patches released 21 Oct 2026; verify version compliance with a trusted source.
- Capture remediation evidence (patch version, config change) in your control‑mapping repository for audit readiness.
Source: Kaspersky SecureList – Critical PHP Vulnerabilities (CVE‑2026‑109618/619)