{"id":12169,"date":"2026-10-21T04:56:53","date_gmt":"2026-10-21T10:56:53","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-117-two-critical-vulnerabilities-in-php-with-pending-emergency-update\/"},"modified":"2026-10-21T13:36:35","modified_gmt":"2026-10-21T19:36:35","slug":"alert-2026-117-two-critical-vulnerabilities-in-php-with-pending-emergency-update","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-117-two-critical-vulnerabilities-in-php-with-pending-emergency-update\/","title":{"rendered":"Alert 2026-117 Two critical vulnerabilities in PHP"},"content":{"rendered":"\n

Update<\/strong>: 10\/21\/2026 11:30 AM CDMX<\/p>\n\n

Affected product(s):<\/h2>\n\n

UPDATE:<\/strong> the PHP team has now released the update https:\/\/www.php.net\/downloads.php?source=Y<\/a><\/p>\n\n

PHP Branch<\/strong><\/td>Affected Status<\/strong><\/td>Fixed Version<\/strong><\/td><\/tr>
PHP 8.5.x<\/strong><\/td>Pending official confirmation of the affected range<\/td>Pending publication<\/td><\/tr>
PHP 8.4.x<\/strong><\/td>Pending official confirmation of the affected range<\/td>Pending publication<\/td><\/tr>
PHP 8.3.x<\/strong><\/td>Pending official confirmation of the affected range<\/td>Pending publication<\/td><\/tr>
PHP 8.2.x<\/strong><\/td>Pending official confirmation of the affected range<\/td>Pending publication<\/td><\/tr>
PHP 8.1 and earlier<\/strong><\/td>Scope pending confirmation; branches outside official PHP support<\/td>No fix announced; also verify vendor support<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The affected status comes from PHP’s preventive advisory; the support situation of older branches is listed in their list of unsupported versions<\/p>\n\n

Description<\/h2>\n\n

The PHP security team announced an emergency update to fix two critical vulnerabilities, identified by researchers as CVE-2026-109618 and CVE-2026-109619, related to remote code execution. PHP assigned both a CVSS v4.0 score of 9.2 and scheduled publication for October 21, 2026 at 14:00 UTC \u201411:00, UTC\u22123\u2014, although it could be brought forward in case of disclosure of details or evidence of exploitation.<\/p>\n\n

At the time of consultation, the official advisory did not yet specify the affected versions, exploitation requirements, or fixed versions. You are urged to prepare for urgent deployment and maintain vigilance over official channels.<\/p>\n\n

Both vulnerabilities allow remote code execution (RCE), and a research team has reportedly reproduced CVE-2026-109618. Some of the information was leaked before the planned disclosure, but the manufacturer keeps complete technical details pending.<\/p>\n\n

Both vulnerabilities are detailed below:<\/p>\n\n

Identifier<\/strong><\/td>Reported Impact<\/strong><\/td>Officially Announced Score<\/strong><\/td>Pending Information<\/strong><\/td><\/tr>
CVE-2026-109618<\/strong><\/td>Remote code execution; The flaw is reported to have been reproduced.<\/td>CVSS v4.0: 9.2<\/td>Technical cause, affected configurations, requirements, and fixed versions.<\/td><\/tr>
CVE-2026-109619<\/strong><\/td>Remote code execution reported by researchers.<\/td>CVSS v4.0: 9.2<\/td>Technical cause, affected configurations, requirements, and fixed versions.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The main risk<\/strong> is that the publication of patches or a functional proof of concept (POC) will rapidly reduce the barrier to developing and automating exploitation attempts: attackers could analyze the changes, adapt tools, and perform mass scans against PHP services exposed to the Internet. Given the remote code execution potential of CVE-2026-109618 and CVE-2026-109619, a delay in remediation could facilitate the compromise of servers, the theft of information, or the installation of backdoors.<\/p>\n\n

Although not all exploitation requirements are yet known, and it cannot be assured that any installation is vulnerable, a short response window should be anticipated and the immediate update of affected systems prepared, without waiting to observe attacks within your organization.<\/p>\n\n

Temporary Mitigation<\/h2>\n\n

The recommendation shared by the well-known researcher Kostas[1]<\/sup><\/a> consists of disabling upload progress tracking using the following directive in the php.ini file (if you are on PHP 8.2):<\/p>\n\n

session.upload_progress.enabled = Off<\/p>\n\n

This should be presented as a provisional exposure reduction measure, not as a validated solution for both CVEs. The publication itself expresses doubts about its coverage; PHP has not yet confirmed in its official advisory that this setting blocks both vulnerabilities.<\/p>\n\n

Implementation Considerations<\/strong><\/p>\n\n