Urgent PHP CVEs: What You Can Do Before Patching

Two highly critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619—are putting PHP websites on high alert. Reports indicate that the issues may allow unauthenticated remote code execution, and early attacks have reportedly already started.

The most important advice is simple: patch PHP as soon as the fixed releases are available. The PHP team has stated that upgrading is the only confirmed mitigation.

While waiting for patched packages, administrators may consider these temporary steps:

• Disable session.upload_progress.enabled.
• Block requests with a multipart Content-Type at the web server where file uploads are not required.
• If a site cannot be taken offline, consider making it read-only by rejecting non-GET and non-HEAD requests.

These measures are not proven to stop the vulnerabilities. The reported exploit appears to involve PHP’s session upload-progress functionality, which can process upload data before an application runs. Blocking multipart requests at the web-server level may also help if the suspected second attack path involves multipart handling, but that has not been confirmed.

Several commonly suggested settings are unlikely to be sufficient on their own. For example, setting file_uploads = Off does not stop PHP from parsing the multipart request, and application-level protections such as login checks, CSRF protection, maintenance mode, or security plugins run too late to prevent PHP from parsing the request body.

If you use a WAF, make sure the origin server cannot be reached directly, or attackers may be able to bypass the WAF entirely.

Treat these steps as emergency risk reduction—not a replacement for updating PHP. Once patched releases are available, install them immediately and review which temporary mitigations can safely be rolled back.