ON 20 October 2026, the PHP security team issued a preliminary notice about two critical remote‑code‑execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. Patches were released on 21 October 2026 at 14:00 UTC after details of the flaws leaked publicly ahead of an embargo.
The vulnerabilities arise from the handling of multipart/form-data in combination with PHP’s session upload progress mechanism (session.upload_progress) in the PHP core, and are described as use-after-free and memory corruption. Exploitation does not require authentication; an attacker with network access to a PHP application can execute arbitrary code as the PHP process.
The flaws affect PHP versions 5 through 8, with branches from 8.2 to 8.5 currently supported; older branches have reached end of life. Sansec estimates widespread exploitation could begin within minutes of the update. Backported patches have been released for 7.4, 8.0 and 8.1.
The exploit has been demonstrated online under the name PHP2Shell and is reported to impact widely used CMS platforms and frameworks, including WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS, though at the time of publication the exact exploitation details had not been independently verified.
Practical response guidance from Sansec and PHP advisories urges administrators to inventory PHP-based systems, disable session.upload_progress, block multipart requests on nginx and Apache, consider isolating internet-facing PHP apps, and be ready to apply patches immediately while planning upgrades for unsupported versions. Detection guidance from Kaspersky notes alerts and specific rules in EDR, KATA, and related tools when exploitation occurs.