Patches were released on Wednesday, October 21, 2026, at 14:00 UTC.
CVE-2026-109618 and CVE-2026-109619: scope and technical root cause
On October 20, 2026, the PHP security team published a preliminary notice describing two critical remote code execution vulnerabilities given identifiers CVE-2026-109618 and CVE-2026-109619. Both flaws carry a CVSS score of 9.2 and, according to published advisories, affect PHP versions starting from 5.4.0 across the PHP 5, 6, 7, and 8 series. PHP maintainers released expedited patches on October 21 at 14:00 UTC after details leaked publicly before the intended embargo.
The underlying issue, as described by the researcher who published a proof-of-concept, involves PHP’s handling of multipart/form-data together with the session upload progress mechanism (session.upload_progress). The problems fall into the categories of use-after-free and memory corruption, which means application-level mitigations cannot fully remediate the flaw — updating the PHP runtime is the only complete fix documented by the PHP security advisory.
Leak, demonstration and targets shown in the PoC
The disclosure began with a post on Hacker News describing two RCE vulnerabilities, quickly followed by independent confirmation from other researchers. Alongside the leak, an exploit dubbed "PHP2Shell" appeared online. In a leaked demonstration video, the exploit was shown operating on web servers running WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, and WHMCS. The publisher of the PoC linked the issue explicitly to session.upload_progress behavior; the authenticity and exact behavior of the published demonstration, however, had not been independently verified at the time of the advisory.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleImmediate mitigations recommended before patches
Because the vulnerability cannot be mitigated solely in application code, the published pre-patch guidance focused on reducing exposure until updates could be installed. Sansec and PHP recommended administrators of Internet-facing PHP servers take several concrete steps: conduct an inventory of all PHP-based systems including control panels and third-party software; disable upload-progress by setting session.upload_progress.enabled = Off using the php_admin_flag in PHP-FPM pools; block multipart requests at nginx and Apache; and consider temporarily isolating PHP applications that have Internet connectivity. Administrators were urged to ensure they were ready to install the released patch immediately and to plan migrations of unsupported branches (8.1 and earlier) to the latest PHP branch.
Detection and response: Kaspersky’s coverage and signatures
Kaspersky reported multiple detection capabilities for both exploitation and post-exploitation activity. Kaspersky Endpoint Detection and Response alerts on suspicious actions originating from web-server processes with rules such as creating_windows_shell_from_a_web_servers_process, possible_web_shell_creating_via_exploit, spawning_process_from_webserver_more_filters_linux, webserver_interpreter_execution_linux, and executable_file_in_www_folder. Network-level detection of attempted exploitation is handled by Kaspersky Anti Targeted Attack (KATA) with verdicts labeled Exploit.CVE-2026-109618.HTTP.C&C and Exploit.CVE-2026-109619.HTTP.C&C. Kaspersky’s endpoint portfolio (now offered as Kaspersky Next) also reports post-exploitation behavior via Behavior Detection signatures including PDM:Exploit.Linux.Generic and PDM:Exploit.Win32.Generic.
What this means for administrators, platform operators, and defenders
- Administrators and hosting operators: treat the advisory as requiring immediate action — patches were published at 14:00 UTC on October 21 and are the only full remediation; follow the inventory, disable-upload-progress, multipart-blocking, and isolation recommendations until updates are applied.
- Operators of affected web platforms (WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal, WHMCS): expect that vulnerable deployments of these common platforms could be targeted if their PHP runtime is unpatched, because the exploit demonstration showed these platforms as execution points in the leaked PoC.
- Defenders and incident response teams: monitor for the Kaspersky detection indicators named above and be prepared for rapid exploitation — Sansec estimated widespread exploitation could begin within 15 minutes of the update’s release, underscoring the urgency of patch deployment and detection tuning.
The factual record from PHP and subsequent vendor advisories is stark: these are high-severity, unauthenticated RCEs tied to core PHP behavior and resolvable only by updating the interpreter. With patches now released and multiple defensive detections available, the near-term priority for operators is simple and concrete — inventory, temporary hardening, and immediate patch installation. The next question left by the timeline is operational: how quickly can large estates move from identification to complete patching, especially where unsupported branches required backported fixes?
