Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. This diary will be continuously updated today. I am starting to write this diary with many details still unclear and with the…
Vulnerabilities mentionedAll →
- CVE-2026-1096199.26%PHP has various global state that temporarily points into request memorypublished · php php PoC ×7+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109619 |
Full article288 words · extracted from isc.sans.edu · click to collapse
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available.
This diary will be continuously updated today. I am starting to write this diary with many details still unclear and with the patch not yet available.
Which versions of PHP are vulnerable?
The easy answer: All of them. At least starting with PHP 5, including the most recent releases.
Which versions will receive patches?
Only PHP 8 is expected to receive a patch. Older versions are no longer supported. The patch is expected to be released at 14:00 UTC today, October 21st. [php]
Does this vulnerability affect specific configurations or extensions?
The vulnerability is in the PHP core, and all default PHP installations are expected to be vulnerable (see below for mitigations).
What steps can I take to mitigate the vulnerability, ahead of applying the patch?
Early guidance suggests that the configuration setting "session.upload_progress.enabled = Off" provides partial mitigation against the vulnerability being exploited. Buy default, this setting is "On".
Are there WAF rules or other measures to protect a site running PHP?
Yes. I will add more as I have verified them. Cloudflare appears to already have deployed some protections. Other vendors have likely done the same.
Have exploits been seen "in the wild"?
Cloudflare is reporting exploits [cloudflare]. PoC exploits, and vulnerability details have been released [jackalsyn]
[cloudflare] https://x.com/IntCyberDigest/status/2112845843938054610/photo/1
[jackalsyn] https://jackalsyn.com/posts/php-up-2026.html
[php] https://www.php.net/archive/2026.php#2026-10-20-1
--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
Text extracted automatically; images, tables and formatting may be missing. Original: https://isc.sans.edu/diary/rss/33440
Akamai Blog