Reports have emerged regarding two critical remote code execution (RCE) vulnerabilities in the PHP programming language, identified by the reserved CVE numbers CVE-2026-109618 and CVE-2026-109619. These vulnerabilities are reported to carry a CVSS score of 10.0, the highest possible severity rating, indicating they could allow an attacker to execute arbitrary code on a server. The scope of the issue is significant, as the vulnerabilities reportedly affect all versions of PHP from version 5 onwards.
Technical details suggest the flaws involve two heap use-after-free primitives within PHP's `session.upload_progress` handler. Because PHP powers a massive portion of the web—including major platforms like WordPress, Laravel, Drupal, Joomla, and Magento—the potential impact is widespread. Some reports suggest that approximately 70% of all websites could be vulnerable. Furthermore, there is concern that older versions of PHP, specifically versions 5 and 7, may not receive the urgent security patches required to remediate the flaws.
In response to the reports, various mitigation strategies have been discussed. One suggested method is to disable the affected feature by setting `session.upload_progress.enabled = Off` in the `php.ini` configuration file. However, some reports indicate that configuration changes alone may not be sufficient to fully protect systems, and a core patch to the PHP engine is necessary. Other suggested measures include blocking multipart requests at the web server level or, in extreme cases, isolating internet-facing applications from public networks until a formal patch is released and applied. Official announcements regarding the fix were expected in late October 2026.