PHP — Critical Core Vulnerability Affects Multiple Versions (CVE-2026-109618, CVE-2026-109619)

Publication date: October 21, 2026
Category: Critical Vulnerabilities (Realtime Trigger)

Introduction

The SANS Internet Storm Center (SANS ISC) has elevated its alert level (infocon) to Yellow following the disclosure of a critical vulnerability affecting the core engine of the PHP programming language. This decision is driven by PHP’s widespread presence across global web infrastructure, the expected severity of the flaw (preliminarily estimated at a CVSS score of 9.4), and the rapid emergence of proof-of-concept (PoC) exploits alongside active exploitation reports in production environments by security vendors such as Cloudflare.

What is the PHP Core Vulnerability? (General Analysis)

The flaw resides directly within the internal processing logic of the PHP core, meaning that virtually any default PHP installation is inherently exposed to the attack vector. Due to the foundational nature of the affected component, the potential risk ranges from Remote Code Execution (RCE) to Denial of Service (DoS) depending on how malicious inputs are parsed.

  • Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Estimated Score: 9.4 Critical — Note: Reasoned estimation based on preliminary descriptions in the absence of an official NVD record at the time of analysis).
  • Estimated CWE Classification: CWE-20 (Improper Input Validation) and CWE-400 (Uncontrolled Resource Consumption).

How Does It Work? (Technical Analysis)

The exploitation mechanism identified in preliminary analyses and public proof-of-concepts involves HTTP POST requests accompanied by payloads formatted as multipart/form-data, which are commonly utilized for file uploads or complex form submissions.

  • Initial Exploit Entry Flow: The vulnerability trigger is initiated by submitting requests containing abnormally large filenames (spanning several megabytes) combined with specific core parameters, such as session upload progress handling (PHP_SESSION_UPLOAD_PROGRESS).
  • Flaw Mechanism and Parsing: When processing massive filenames or anomalous multipart structures within the PHP parsing engine, an abnormal condition occurs in memory management or input validation, allowing an attacker to corrupt the interpreter’s execution flow.
  • Exploit Status: Public PoCs analyzed thus far (such as those documented in third-party research) exhibit unstable or incomplete behavior, yet they provide sufficient indicators regarding the malicious traffic patterns required to build defensive detection signatures.

Affected Systems / Environments

The impact of this incident spans a broad spectrum of the web development ecosystem:

  • Affected Versions: Virtually all PHP versions starting from the 5 branch, including the most recent iterations of the 8.x branches.
  • Patch-Supported Versions: The PHP development community has scheduled security updates exclusively for the PHP 8 branch. Older versions are no longer supported (End-of-Life) and will not receive direct vendor patches.
  • Linux Distributions: Vendors such as Ubuntu have announced plans to release backported patches for PHP versions included in their actively supported releases (LTS).
CVE Category (Estimated CWE) Impact Estimated CVSS Vector (Condensed)
CVE-2026-109618 CWE-20 (Improper Input Validation) Code Execution / Memory Manipulation 9.4 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-109619 CWE-400 (Resource Consumption) Denial of Service / Exhaustion 7.5 (High) AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Mitigation and Detection

Remediation

  • Priority Patching: Apply the official patches released by PHP.net as soon as they become available for your supported branch (PHP 8). On managed operating systems, monitor official distribution repositories.
  • Temporary Configuration Mitigation: As a preliminary contingency measure ahead of patching, it is strongly recommended to disable session upload progress tracking within php.ini:
    ini 
    session.upload_progress.enabled = Off
    (Note: By default, this directive is set to On).
  • Size Restriction: Limit the maximum allowed request size in your web server configuration (Nginx, Apache) and PHP directives (post_max_size and upload_max_filesize) to hinder the reception of oversized payloads.

Detection

Defensive teams should actively monitor web access logs for POST requests featuring unusually large multipart/form-data bodies, particularly those targeting endpoints that handle sessions or file uploads with manipulated parameter names.

Defensive Operation Warning: The presence of POST requests containing multi-megabyte bodies and excessively long filenames within web access logs serves as a strong Indicator of Compromise (IoC) for exploitation attempts against this PHP core vulnerability.

Wrapping Up

The critical vulnerability discovered in the PHP core poses a significant risk to global web infrastructure due to the language’s omnipresence and the rapid availability of functional exploits. Although developers have prioritized support for the PHP 8 branch, the vast inventory of legacy applications running on unsupported versions will require system administrators to deploy rigorous configuration mitigations and perimeter filtering strategies via WAFs.

References