CVE-2026-109618(php / php)

Listo! Mañana se prende fuego el 70,2% de Internet. Si usas #PHP, preparate, desde esta noche van a ser días largos. Info y FAQ sobre CVE-2026-109618 y CVE-2026-109619 (en desarrollo) https://blog.segu-info.com.ar/2026/10/vulnerabilidad-critica-10-de-10-en-php.html

CVE-2026-109618 と CVE-2026-109619 のCVSSスコアがなんと10.0！！！ 日本時間の木曜日の25時に発表される予定の奴らしくまだホントかどうかわからないけど…PHPのver.5以降が全部対象でリモートコードが実行される恐れがあるって https://threatlandscape.io/blog/php-core-rce-cve-2026-109618-109619-leak-ahead-of-embargo

‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms. PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift. CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro". Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later. PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.

... get it while its hot... 😈 > CVE-2026-109618 / CVE-2026-109619 (pre-patch PHP 8.x) > session.upload_progress UAF > https://jackalsyn.com/posts/php-up-2026.html > Courtesy of Me, @acd421 & @Archknight23 #CyberSecurity #infosec #php2shell #php https://t.co/JM1f86Bjm9

php2shell - CVE-2026-109618 / CVE-2026-109619 https://github.com/ikow/php2shell-poc

Here is a full list of what you can do NOW for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) as a temporary mitigation. (generated and validated by LLM) 1️⃣ Do this first. In php.ini or the FPM pool, set: session.upload_progress.enabled = 0 Reload PHP-FPM, then update PHP right after the release (21 Oct, 14:00 UTC). 2️⃣ Edge block until you patch. It blocks the PHPSESSID cookie and query (also lowercase and URL-encoded), and all multipart/form-data requests. ⚠️ File uploads stop working until you remove it. ☁️ Cloudflare (WAF custom rule, action Block): (lower(url_decode(http.cookie)) contains "phpsessid") or (lower(url_decode(http.request.uri.query)) contains "phpsessid") or (any(lower(http.request.headers["content-type"][*])[*] contains "multipart/form-data")) 🟩 nginx (http {} context): map "$http_cookie|$args|$content_type" $block_php2shell { default 0; "~*(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)" 1; "~*multipart/form-data" 1; } In each server {} block: if ($block_php2shell) { return 403; } 🔒 Caddy: @php2shell expression `{header.Cookie}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {query}.matches("(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)") || {header.Content-Type}.matches("(?i)multipart/form-data")` respond @php2shell 403 🚦 Traefik v3 (Coolify: Server > Proxy > Dynamic Configurations). Add this to the https router and also to a copy for the http entrypoint: http: routers: block-php2shell: rule: "HeaderRegexp(`Cookie`, `(?i)(?:p|%[57]0)(?:h|%[46]8)(?:p|%[57]0)(?:s|%[57]3)(?:e|%[46]5)(?:s|%[57]3)(?:s|%[57]3)(?:i|%[46]9)(?:d|%[46]4)`) || QueryRegexp(`PHPSESSID`, `.*`) || HeaderRegexp(`Content-Type`, `(?i)multipart/form-data`)" priority: 100000 entryPoints: [https] middlewares: [deny-all] service: noop@internal tls: {} middlewares: deny-all: ipAllowList: sourceRange: ["255.255.255.255/32"] ✅ Test: curl -s -o /dev/null -w '%{http_code}\n' -H 'Cookie: PHPSESSID=x' https://your-app → 403 curl -s -o /dev/null -w '%{http_code}\n' -F a=b https://your-app → 403 The edge block does not protect direct origin access. Disable upload_progress and patch PHP.

🚨 Vulnerabilidades críticas en PHP: qué está pasando y qué hacer Hoy, 21 de octubre a las 16:00 (hora peninsular), PHP publica una actualización urgente que corrige dos vulnerabilidades críticas (CVE-2026-109618 y CVE-2026-109619, CVSS 9,2). 🔎 Qué sabemos Son fallos de ejecución remota de código: permitirían tomar el control del servidor sin credenciales. La información se filtró ayer, así que se esperan ataques masivos en cuanto salgan los detalles. Aún no se conocen las versiones afectadas. Hay que dar por vulnerable cualquier web con PHP (WordPress, WooCommerce, Prestashop…). ⏳ Qué esperamos Solo recibirán parche las ramas con soporte (PHP 8.2 en adelante). Las versiones antiguas (7.x, 8.0, 8.1) no tendrán parche oficial. Si tu web va con una de ellas, es momento de migrar. ✅ Qué hemos hecho nosotros En todos los servidores que operamos, propios y de clientes, ya hemos aplicado una mitigación preventiva: desactivar el progreso de subida de ficheros de PHP, bloqueado para que ningún dominio pueda reactivarlo. El único efecto es que puede dejar de verse la barra de progreso al subir archivos. Es una medida no oficial, pero consideramos que compensa con creces. En cuanto salgan las versiones corregidas, actualizaremos. 🛠 Si administras tu propio servidor Crea php.d/99-no-upload-progress.ini con: session.upload_progress.enabled = Off Y en el pool de PHP-FPM, para que ningún dominio lo reactive: php_admin_flag[session.upload_progress.enabled] = off Reinicia PHP-FPM y actualiza PHP en cuanto esté disponible. Seguiremos informando...

🔴 php2shell adlı araçla CVE-2026-109618 / CVE-2026-109619 PHP RCE'lerini gösterdiği iddia edilen @k_firsov tarafından yapılan paylaşım. Şu sistemlere RCE denemeleri yapıyor: WordPress 7.1.3 MediaWiki 1.46.2 phpBB 3.3.17 Magento 2.4.9 Laravel (13.x ve 8.x) Symfony 8.1.9 Drupal 11.4.10 Düz mod_php Yama yayınlandığı an PHP sürümlerinizi güncellemeyi unutmayın!

‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online. Researchers report potential RCE. CVE-2026-109618 and CVE-2026-109619. Fixes scheduled for October 21, 14:00 UTC. Details - https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html

🚨 PHP is going to be dropping emergency security updates tomorrow (October 21st, 14:00 UTC). - CVE-2026-109618 & CVE-2026-109619 are unauthenticated RCE vulnerabilities both with a score of CVSS 9.2 - The RCE appears to work on default installations of many services & frameworks such as WordPress, Magento, Laravel and more - PHP versions >5.4.0 affected - Discovered by team @calif_io https://x.com/k_firsov/status/2112641845926989944/video/1

We've released php2shell-protection, an emergency Apache mitigation and testing toolkit for CVE-2026-109618 / CVE-2026-109619. ⚠️ Not based on official vulnerability details. This is a precautionary measure based on information circulating in the security community and zero-day PoC material we've obtained and reviewed. It blocks multipart POST requests before they reach PHP. Not a substitute for patching. https://github.com/syhunt/php2shell-protection #php #Cybersecurity

¡Vulnerabilidad MUY grave de PHP! ⚠ 2 vulnerabilidades CRÍTICAS ⚠ CVE-2026-109618 y CVE-2026-109619 ⚠ Gravedad 9.2/10 ✨ Ejecución remota de código: Permite tomar el control del servidor sin necesidad de credenciales ✨ En principio, vulnerable cualquier web con PHP (desde PHP 5 hasta PHP 8): Wordpress, Prestashop, WooCommerce, Moodle... ✨ Sólo habrá parche para ramas PHP 8.2+ ✨ Hoy, 21/10 a las 16:00🇪🇸 se publica el parche. Esto es MUY grave. Con esta vulnerabilidad (y más ahora con la IA) es muy probable que los que no actualicen puedan ser hackeados o troyanizados en poco tiempo. Un abrazo a todos los sysadmin, esto va a ser duro.

About CVE-2026-109618 and CVE-2026-109619, the PHP RCE. The vulnerability is in the PHP's session upload progress path. It was introduced in PHP 5.4, enabled by default and process multipart data before application code. Read below for more info.

対応必須なので各位踏ん張っていきましょう / PHPの重大な脆弱性「php2shell」（CVE-2026-109618、CVE-2026-109619）の概要と対応指針 https://blog.flatt.tech/entry/php2shell

Cloudflare has deployed emergency WAF rules for two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both reportedly rated CVSS 9.2. The risks affect WordPress, Laravel and other PHP-powered applications. If your site is behind Cloudflare, there’s an extra layer of protection. Cloudflare says its initial rules are available to Free-plan customers too, as early attacks emerge. But don’t treat that as a fix: • Verify your traffic passes through Cloudflare. • Check your PHP version and hosting provider’s patch status. • Update PHP as soon as the official security fixes are available. WAF rules are a stopgap, not a substitute for patching. Cloudflare update: https://developers.cloudflare.com/changelog/product-group/application-security/

More details about CVE-2026-109618 and CVE-2026-109619, the PHP RCE. Upload progress can serialize before basic RINT clears BG(serialize) There is currently no possible mitigation. See the screenshot below to understand how I got the UAF 😼 https://t.co/wdUjCP2hRa

https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

Point your LLM(s) at this blogpost & have it try to make inventory & mitigate as many servers ahead of the PHP patch as you can Details are still emerging and this is *not* a definitive mitigation list, the patch is the ONLY 100% fix https://ma.ttias.be/php-cve-2026-109618-early-mitigation/

دو باگ بسیار خطرناک CVE-2026-109618 و CVE-2026-109619 منتشر شده در تمامی نسخه های PHP به مهاجم مهمان امکان گرفتن دسترسی Shell می دهد. بنیاد PHP در آخرین اطلاع رسانی اعلام کرده حداکثر تا ساعت ۱۷:۳۰ امروز به وقت ایران نسخه Patch شده را منتشر خواهد کرد تا آن زمان برای کاهش آسیب از PHP.ini session.upload_progress.enabled = Off را خاموش بفرمایید. لطفا به دوستان خود اطلاع رسانی بفرمایید.

Huntress is aware of reports circulating regarding two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in several versions of PHP (versions 5, 6, 7, and 8). 🧵