SANS ISC reports a critical PHP vulnerability affecting the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619. PHP[.]net announced a critical update and the information ConIns notes that the information level has been raised to YELLOW due to the widespread use of PHP, the anticipated severity (CVSS 9.4) and early PoC exploits ahead of the patch. The patch for PHP 8 is expected to be released around 14:00 UTC on 21 October 2026, with older, unsupported versions unlikely to receive fixes.
In practice, PHP 8.0–8.5 lines are affected, with the versions released on 21 October 2026 listed as currently safe only after patch availability. Ubuntu has already issued updated PHP packages for multiple releases and backport considerations may apply.
The two CVEs describe distinct issues in the PHP core that enable remote code execution and memory-related exploitation. CVE-2026-109618 is an out-of-memory corruption in multipart MIME processing which can bypass post_max_size, ignore header limits, and exhaust memory via empty file handling and large filenames.
CVE-2026-109619 involves a use-after-free where global request state is not fully reset before memory is freed, requiring a specific error and a triggering warning, with exploitation demonstrated in PHP 8.5 under certain conditions (e.g., local overrides like .htaccess). PoC exploits have circulated, including a very large filename, though reliability is variable.
Early mitigations include turning off session.upload_progress (session.upload_progress.enabled = Off) and tightening request size limits; WAF protections (Cloudflare, others) are noted as present. The primary remedy remains applying the official patch; distributions may backport fixes and provide updated packages. Further mitigations and protections are being refined as more details emerge. References include GHSA advisories and Ubuntu security notices cited in the diary.