2 Critical PHP Vulnerabilities Disclosed – Risk of Remote Code Execution (RCE) Attacks

What Happened?

On 20 October 2026, technical information concerning two critical PHP vulnerabilities surfaced publicly ahead of the planned coordinated security disclosure.

On the same day, the PHP development team announced an emergency security release to address both vulnerabilities, scheduled for 21 October 2026 at 14:00 UTC, confirming a critical CVSS v4.0 severity score of 9.2 for each issue.

According to CloudSEK’s analysis, the vulnerabilities may be associated with a memory-management weakness in PHP’s native file-upload progress functionality, potentially allowing attackers to exploit the processing of file-upload requests to achieve remote code execution.

However, at the time of CloudSEK’s report, affected PHP versions had not been officially confirmed, and the sources reviewed did not confirm any in-the-wild exploitation.

Where Are Organisations Potentially Exposed?

CloudSEK’s report highlights that the vulnerabilities concern the PHP runtime itself, rather than a specific website plugin or application.

This means organisations relying on PHP-based technologies could potentially be affected, including:

• Content Management Systems (CMS): Websites powered by WordPress, Drupal, Joomla, and Magento.
• E-commerce Platforms: Online stores, customer portals, and web-based transaction systems.
• Enterprise Web Applications: Custom-built business applications developed using PHP.
• Web Hosting and Web Servers: Particularly shared hosting environments supporting multiple websites.
• Enterprise Systems and Appliances: Business infrastructure and devices containing embedded PHP components.

Internet-facing systems are of particular concern because attackers may be able to reach vulnerable functionality remotely.

However, running PHP does not automatically make a system exploitable. Actual exposure depends on the affected versions and technical preconditions, which were still awaiting official confirmation from the PHP development team at the time of the report.

How Could the Vulnerabilities Be Exploited?

According to preliminary security research reviewed by CloudSEK, the vulnerabilities may involve a memory-management weakness known as Use-After-Free (UAF) within PHP’s session.upload_progress functionality.

This built-in feature tracks the progress of file uploads and is enabled by default in PHP. It operates while PHP processes upload requests, before the application’s own code begins execution.

The reported weakness could potentially allow an attacker to submit specially crafted upload requests that trigger access to memory that has already been released. Under certain conditions, this could lead to memory corruption and potentially enable unauthorised code execution.

If successfully exploited, an attacker could execute commands with the privileges of the PHP process running on the affected server.

CloudSEK reviewed the relevant PHP source code and confirmed the existence of internal code paths consistent with the reported research. However, the complete exploitation chain and technical root cause had not been officially confirmed by the PHP development team at the time of publication.

Why Does This Matter to Businesses?

Successful exploitation of these vulnerabilities could create serious operational and cybersecurity risks, including:

• Data Breaches: Unauthorised access to sensitive business information, customer records, database credentials, or application configuration data.
• Server Compromise: Execution of malicious commands or deployment of web shells to establish persistent access to affected systems.
• Business Disruption: Website defacement, service outages, unauthorised file modifications, or changes to server configurations.
• Expanded Cyberattacks: Potential compromise of additional systems, particularly within shared hosting or multi-tenant environments where isolation between services is insufficient.

For organisations relying on websites and web applications to support essential business operations, these risks highlight the importance of proactive vulnerability identification, timely remediation, and continuous security monitoring.

What Should Organisations Do Now?

CloudSEK recommends that organisations implement precautionary measures while closely following official PHP security updates.

1. Identify Exposed PHP Systems

Review internet-facing websites, applications, APIs, and hosting infrastructure to identify PHP deployments, determine the versions in use, and assess potentially vulnerable configurations.

2. Apply Official Security Patches

Prioritise vendor-confirmed security updates as soon as they become available, particularly for internet-facing and business-critical systems.

3. Disable Unnecessary Upload-Progress Functionality

Where the upload-progress feature is not required, organisations should consider disabling it through the following configuration:

session.upload_progress.enabled = Off

This is an interim risk-reduction measure based on the reported vulnerability mechanism. It has not been confirmed to address both CVEs and should not replace official security patches.

4. Restrict Unnecessary File-Upload Requests

Allow multipart/form-data requests only on application routes and API endpoints that genuinely require file-upload functionality, reducing unnecessary exposure to potentially vulnerable code paths.

5. Strengthen Security Detection and Monitoring

Monitor for suspicious activity, including unexpected processes spawned by PHP workers, unusual PHP worker crashes, abnormal file-upload requests, and unauthorised modifications to web directories or server configurations.

Organisations operating end-of-life PHP versions should also prioritise restricting access to affected systems or planning upgrades to supported versions.

Staying Ahead of Emerging Threats with CloudSEK, Managed by BMSP

The disclosure of CVE-2026-109618 and CVE-2026-109619 demonstrates how vulnerabilities affecting widely adopted technologies can introduce significant cybersecurity risks across business environments.

For organisations, effective cybersecurity requires more than simply waiting for security patches. It demands continuous awareness of emerging threats, visibility into exposed digital assets, and the ability to assess potential security risks before vulnerabilities can be exploited.

CloudSEK, managed by BMSP, supports a more proactive approach to cybersecurity through Threat Intelligence and Digital Risk Visibility, helping organisations strengthen their awareness of emerging threats and potential exposure across their digital environments.

By combining CloudSEK’s Threat Intelligence capabilities with BMSP’s managed cybersecurity expertise, organisations can enhance their ability to identify emerging security risks, understand their potential business impact, and make more informed cybersecurity decisions.

As cyber threats continue to evolve, timely threat intelligence and proactive risk management remain essential for protecting critical systems, sensitive information, and business continuity.

Protect your digital assets before threats become incidents.

Contact BMSP to discover how CloudSEK, managed by BMSP, can help strengthen your organisation’s cybersecurity strategy and support a more proactive approach to digital risk management.

Reference

CloudSEK Global Threat Intelligence (GTI) – CVE-2026-109618 and CVE-2026-109619: Remote Code Execution in PHP File-Upload Progress Functionality, 21 October 2026.