PHP session.upload_progress heap UAF CVE-2026-109618/-109619
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
PHP plans a 14:00 UTC release on 21 October 2026 for two CVSS 9.2 flaws after a leak.
Servers running PHP face a weaponized exploit before most are patched.
Background
PHP is the widely used server-side scripting language that powers many websites and web applications. Its security team, including Jakub Zelenka, pre-announced an out-of-band release for two critical vulnerabilities rated CVSS v4.0 9.2, both tied to the session.upload_progress handler (the feature that tracks file-upload progress). The release was pulled forward from 22 October to 21 October after details and a proof-of-concept tool called "PHP2Shell" surfaced early, and security firm watchTowr confirmed the leak was genuine and reproduced one of the flaws.
How it unfolded
- Oct 20, 2026PHP pre-announces an out-of-band security release for two critical vulnerabilities, both CVSS v4.0 9.2, set for 21 October 2026 at 14:00 UTC, reserving the right to release earlier if details go public.
- Oct 20, 2026Details leak early; a proof-of-concept tool called "PHP2Shell" surfaces, and watchTowr confirms the leak is genuine and reproduces one of the vulnerabilities, confirming CVE-2026-109618 and CVE-2026-109619.
- Oct 20, 2026Because attack concepts were exposed early, PHP moves the release from the originally planned 22 October forward by one day to 21 October.
- Oct 21, 2026 00:30 UTCResearcher Jλckλι (@J4ck3LSyN) posts that they recreated and lab/field tested both CVEs, describing two heap use-after-free primitives in PHP's session.upload_progress handler.
- Oct 21, 2026 01:00 UTCPenTestIT publishes a status roundup: CVE IDs not yet named by PHP, severity 9.2 for both, fixed builds pending for 14:00 UTC, no vendor workarounds, no exploitation reported, no public PoC, no NVD record.
- Oct 21, 2026 01:51 UTCDaniele Berardinelli (@rina4_tot) posts more technical details, says there is currently no possible mitigation, and links a PoC on Pastebin.
- Oct 21, 2026 03:02 UTCSecureLayer7 publishes guidance calling the next 24 to 48 hours an active incident-readiness window rather than a routine patch cycle.
- Oct 21, 2026 05:00 UTChkepc reports the double high-risk RCE vulnerabilities leaked 14 hours ahead of schedule and that many servers may be at risk of intrusion.
Who’s saying what
- Official
- PHP's security team says all PHP users should prepare to update as soon as the release is available and may ship earlier if details go public or exploitation is seen.
- Analysts
- PenTestIT says only PHP's four stated facts should be treated as confirmed, and everything else is a leak, a relay of a leak, or a guess.
- Caution
- SecureLayer7 calls the next 24 to 48 hours an active incident-readiness window, noting the bugs are described as unauthenticated and reachable over the network.
- Expert
- Researcher Daniele Berardinelli says there is currently no possible mitigation, while Pablo Dall'Oglio asks whether disabling upload_progress.enabled and using an alternative session handler would help.
Still unverified
PenTestIT says the link to PHP's session upload progress feature and the RCE classification are unconfirmed, with type, precondition and affected versions pending. SecureLayer7 says disabling session.upload_progress.enabled is an unverified, community-suggested stopgap based on the speculated root cause. hkepc reports screenshots and a PoC demonstration of a potential attack tool named "PHP2Shell" appeared online, suggesting attackers may need no authentication.