A security researcher has identified a heap use-after-free (UAF) vulnerability in PHP, specifically involving the `session.upload_progress` mechanism. This flaw, identified as CVE-2026-109618 and CVE-2026-109619, occurs during the handling of multipart form data. In a use-after-free scenario, the system continues to reference a memory address after it has been deallocated; in this specific case, the 'use' of that memory can lead to the execution of arbitrary code by an attacker.
Technical discussions surrounding the vulnerability emphasize that the issue is deeply rooted in how PHP manages memory during file uploads. One commenter on Hacker News noted that the vulnerability is severe because it directly enables arbitrary code execution. Furthermore, the discussion clarified a critical distinction regarding mitigation: while many users might assume that disabling specific PHP configuration options, such as `session.upload_progress.enabled`, would provide a safeguard, some analysis suggests that the underlying multipart UAF vulnerability may remain exploitable regardless of those specific settings.
Because the vulnerability is tied to the core handling of multipart/form-data, administrators are looking toward broader system-level protections. Commenters suggested that security modules like SELinux or AppArmor may serve as more effective stopgaps than PHP-specific configuration changes. Additionally, there is ongoing uncertainty regarding the timeline for patches in major distribution repositories, such as Debian, which affects how quickly production environments can be secured against the exploit. The complexity of the report and the underlying memory management issues highlight the persistent challenges of securing long-standing programming languages against sophisticated memory corruption flaws.