Multiple security vulnerabilities have been identified in PHP, affecting the core runtime used by many web applications and shared hosting environments. The flaws are described in unverified claims as remote code execution issues, creating a high-risk exposure for internet-facing systems. Official affected versions have not been named, although unverified claims suggest releases from PHP 5 onward may be affected. No confirmed in-the-wild exploitation or public proof-of-concept has been reported.
CVE-2026-109618 (CVSS 9.2 – Critical): A reported use-after-free vulnerability in PHP's session upload-progress handler could allow unauthenticated attackers to execute arbitrary code remotely.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in PHP, affecting the core runtime used by many web applications and shared hosting environments. The flaws are described in unverified claims as remote code execution issues, creating a high-risk exposure for internet-facing systems. Official affected versions have not been named, although unverified claims suggest releases from PHP 5 onward may be affected. No confirmed in-the-wild exploitation or public proof-of-concept has been reported.
CVE-2026-109618 (CVSS 9.2 – Critical): A reported use-after-free vulnerability in PHP's session upload-progress handler could allow unauthenticated attackers to execute arbitrary code remotely.[emaillocker id="1283"]
CVE-2026-109619 (CVSS 9.2 – Critical): A second critical PHP vulnerability has reportedly been associated with remote code execution. Detailed technical information has not yet been confirmed in the official advisory.
These vulnerabilities collectively present a severe risk to internet-facing systems that rely on the affected runtime, particularly environments where core code is exposed to untrusted input. Organizations operating web applications or shared hosting services should monitor official vendor communications and prepare to respond promptly. Prompt action is important because the flaws could enable remote code execution before detailed guidance is available.
We recommend you to plan upgrades for servers on PHP 8.1 or older.
The following reports contain further technical details:
[/emaillocker]