Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 16:00 UTC+2

Update timeline

1. investigating Oct 21, 2026, 09:45 AM UTC

   The PHP Security Team has announced an upcoming security release scheduled for Wednesday, 21 October 2026 at 16:00 UTC+2. It addresses two critical vulnerabilities, publicly reported as CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (Critical). Technical details and affected versions are scheduled to be disclosed at that time. We will post updates here as more information becomes available. Official announcement: https://www.php.net/archive/2026.php#2026-10-20-1

2. identified Oct 21, 2026, 01:36 PM UTC

   We have proactively deployed a ModSecurity blocking rule to mitigate the publicly circulating exploit pattern associated with CVE-2026-109618 and CVE-2026-109619, targeting PHP's session upload progress handling in multipart HTTP requests. This mitigation has been rolled out across our Shared Hosting, Managed Dedicated Servers, and Managed VPS environments as an additional layer of protection. Important: This mitigation is a temporary protective measure and does not constitute a complete fix for the underlying vulnerabilities. It does not replace the need to upgrade PHP to the patched versions as soon as they become available. We are closely monitoring the situation and will continue taking the necessary steps to protect our hosting infrastructure and customers.