This morning we wrote that the PHP team ships an emergency update against two critical flaws today, 21 October, at 14:00 UTC. A few hours before the release things got worse: details of the bugs leaked, and tools appeared online whose authors say they can exploit them.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Researchers at watchTowr confirmed both exist and reproduced the first. Early reports point to unauthenticated remote code execution. A researcher going by J4ck3LSyN published PHP-UP-2026 with prototypes for both bugs, and a video of a tool called PHP2Shell is circulating that supposedly runs commands on WordPress, Magento, Joomla, Laravel, Drupal and other platforms.

What is known about the bugs

According to early analyses, the first issue involves session.upload_progress, the mechanism that tracks file uploads through forms. When the session is updated, PHP may touch memory that has already been freed — a classic use-after-free. The mechanism is on by default, so sites that never use it explicitly are at risk too. The second bug may involve handling multipart/form-data, the requests that carry files.

There is no official list of affected versions. Some suggest the problem goes back to PHP 5.4. Only branches 8.2 to 8.5 are supported, so servers on older versions will get no fix from the PHP team. Nobody has independently confirmed that the published exploits work everywhere either.

What to do right now

  • Until the patch lands, set session.upload_progress.enabled to Off in php.ini and restart PHP-FPM or Apache
  • Take a fresh backup of the site and the database
  • Agree with your host or contractor who installs the update this evening, and when
  • If the site runs PHP 7.x or older, plan a move to a supported branch instead of waiting for a patch
  • After updating, check the version on the server, the homepage, forms and checkout

Turning off upload_progress closes the suspected attack path through file uploads, but may not cover the second bug. Updating WordPress, Magento or another CMS does not fix this: the flaw is in the PHP interpreter itself.

Our take

This is exactly the case where keeping details sealed until release did not help: the leak gave attackers a head start. Today is the day to install the PHP update the hour it ships, not sometime this week. The original report is on SecurityLab.