Contents

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow remote arbitrary code execution and reportedly have CVSS v4.0 scores of 9.2. Patched versions are scheduled for release at 23:00 JST on October 21, 2026. Prepare to apply them promptly to affected PHP environments once they become available.

Key Points#

  • The vulnerabilities, dubbed “php2shell,” may involve memory corruption and session management.
  • The PHP development team plans to release patched versions at 23:00 JST on October 21, 2026.
  • session.upload_progress.enabled=0 is a potential mitigation, but is not expected to fully prevent attacks.
  • Before the patches arrive, identify your PHP environments, update procedures, and post-update verification methods.

What We Know#

Public information and research by GMO Flatt Security suggest these are memory corruption vulnerabilities related to PHP session management. Exploitation could allow remote arbitrary code execution. Both have CVSS v4.0 scores of 9.2.

Researchers’ posts show reproductions in environments using mod_php and PHP-FPM, as well as WordPress, Laravel, and Symfony. The impact is not necessarily limited to these environments. This article reflects preliminary information; details will need to be confirmed after the patches are released.

Start by Taking Inventory#

Identify where PHP is used on your organization’s web servers and in its applications. Include containers and cloud services alongside hosted environments, and record the PHP version and execution method.

For each environment, check the PHP update procedure and the steps for verifying that applications work afterward. If you use E2E tests or similar tools, documenting who will run them and how will make it easier to get started once the patches arrive.

Mitigation Before Release#

The article identifies disabling PHP’s Session Upload Progress feature as a potential mitigation.

settings.ini
session.upload_progress.enabled=0

However, GMO Flatt Security believes this setting alone may not fully prevent attacks. If you apply it, check the configuration change procedure and its impact on applications in the target environment. Applying the patched versions is the definitive fix.

Prepare to Limit the Impact#

Review stakeholder contact details and workflows in anticipation of downtime or disconnected sessions during emergency updates. Keep data stored on servers to a minimum, and review permissions for IAM roles, service accounts, and similar identities. This can limit the information exposed after a breach and the risk of an attack spreading to other systems.

Also check that logs are being recorded and preserved. Missing or tampered logs can make it difficult to determine whether an attack occurred and assess its impact.

After the Patches Are Released#

The PHP development team plans to release patched versions at 23:00 JST on October 21, 2026. Once available, check your PHP versions and which environments are affected, then update using the procedures you prepared. Afterward, verify that applications work correctly.

Next Step#

Today, list the servers using PHP and the people responsible for them, and confirm the update and verification procedures for each environment so you are ready when the patches arrive.

Source: https://blog.flatt.tech/entry/php2shell

Contents