October 21, 2026
- PHP fixed CVE-2026-109618 and CVE-2026-109619 after the disclosure embargo collapsed. Public research describes a
session.upload_progressuse-after-free and demonstrates the php2shell RCE path; Sansec reports that it has already been used in the wild. Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; affected EOL branches receive no upstream fix. See PHP’s emergency notice and an independent reproduction. · Vulnerabilities & Exploits