The PHP development team has issued a critical security alert after identifying two vulnerabilities that could allow unauthenticated attackers to execute code remotely on vulnerable servers. Security updates were released on October 21, 2026, followed by an additional advisory on October 23 concerning PHP’s session upload progress feature.<\/p>\n\n\n\n
The October 21 security advisory addresses two vulnerabilities: CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale internal global state. Both flaws could potentially lead to remote code execution under affected conditions.<\/p>\n\n\n\n
The vulnerabilities affect PHP installations serving web requests, including PHP-FPM, Apache with To address the vulnerabilities, PHP released the following security updates:<\/p>\n\n\n\n The PHP team strongly recommends that users update to the appropriate patched release immediately. Users running older PHP versions should check with their operating system or hosting provider for available security fixes.<\/p>\n\n\n\n On October 23, PHP published an additional informational advisory concerning CVE-2026-115560, which involves a specific combination of session serialization settings and enabled upload-progress functionality.<\/p>\n\n\n\n The issue can occur when an application configures As a precaution, PHP recommends disabling session upload progress until the next regular bug-fix release by setting:<\/p>\n\n\n\n Applications that already applied this mitigation following the October 21 advisory do not need to take further action for this recommendation. Applications that never change the serialization handler at runtime can keep upload progress enabled with respect to this specific issue.<\/p>\n\n\n\n The PHP team advises administrators to prioritize security updates and verify that any temporary mitigations are correctly applied. The October 23 advisory is an additional precaution and does not replace the security updates released on October 21.<\/p>\n\n\n\n PHP 8.1 and older no longer receive security updates directly from the PHP project, although some vendors may provide backported fixes. PHP 8.2 is scheduled to reach end of life on December 31, 2026.<\/p>\n\n\n\n Administrators should consult the official PHP advisories and their vendors for further details.<\/p>\n\n\n\n Official sources:<\/strong><\/p>\n\n\n\n Stay updated with the latest technology and cybersecurity news at @w3buddy.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" The PHP development team has issued a critical security alert after identifying two vulnerabilities that could allow unauthenticated attackers to execute code remotely on vulnerable servers. Security updates were released on October 21, 2026, followed by an additional advisory on October 23 concerning PHP’s session upload progress feature. Two Critical Vulnerabilities Identified The October 21 […]<\/p>\n","protected":false},"author":1,"featured_media":5864,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"googlesitekit_rrm_CAowu461DA:productID":"","footnotes":""},"categories":[1],"tags":[1562,1561,1560,1563,1564,1566,1565],"class_list":["post-5863","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-cve","tag-cybersecurity","tag-php-security","tag-php-fpm","tag-remote-code-execution","tag-server-administration","tag-web-development"],"_links":{"self":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/5863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/comments?post=5863"}],"version-history":[{"count":1,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/5863\/revisions"}],"predecessor-version":[{"id":5865,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/posts\/5863\/revisions\/5865"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/media\/5864"}],"wp:attachment":[{"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/media?parent=5863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/categories?post=5863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/w3buddy.com\/blog\/wp-json\/wp\/v2\/tags?post=5863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}mod_php<\/code>, php-cgi<\/code>, FrankenPHP and LiteSpeed. The PHP team highlighted Apache mod_php<\/code> as particularly concerning because an exploit has been demonstrated that can trigger an attack before application code executes.<\/p>\n\n\n\nPatched PHP Versions Released<\/h3>\n\n\n\n
\n
Follow-Up Advisory Issued on October 23<\/h3>\n\n\n\n
session.serialize_handler<\/code> as php_binary<\/code> or php_serialize<\/code>, changes it to php<\/code> at runtime using ini_set()<\/code> before calling session_start()<\/code>, and leaves session upload progress enabled.<\/p>\n\n\n\nsession.upload_progress.enabled = 0<\/code><\/pre>\n\n\n\nPHP Users Urged to Review Security Updates<\/h3>\n\n\n\n
\n