OPEN LINK ↗
// 1h agoSECURITY INCIDENT
PHP Faces php2shell RCE Disclosure
A public proof of concept alleges two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, including a heap use-after-free in session upload-progress handling. Official advisories rate the issues CVSS 9.2 and warn of possible unauthenticated remote code execution, though technical details remain partly unconfirmed.
// ANALYSIS
This is a patch-window emergency for PHP operators, not merely a theoretical bug report.
- –At least one vulnerability reportedly affects `session.upload_progress` and crafted multipart/form-data requests.
- –Disabling `session.upload_progress.enabled` may reduce exposure but reportedly does not address both attack paths.
- –CERT-EU says PHP 5 and later may be affected and recommends immediate patching or isolating internet-facing applications.
- –Developers should treat the circulating exploit material as untrusted until PHP’s official fixes and technical advisory supersede the leaked analysis.
- –The incident highlights the security cost of legacy C-based runtimes embedded across web infrastructure.
// TAGS
phpsecurityopen-sourceinfrastructureself-hosted
DISCOVERED
1h ago
2026-10-21
PUBLISHED
5h ago
2026-10-21
RELEVANCE
7/ 10
AUTHOR
rfarley04