Overview
On October 21, 2026, the PHP project released an emergency security update fixing two critical vulnerabilities in the PHP interpreter core, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and both allow unauthenticated remote code execution. No login is required and no specific application endpoint needs to be exposed: a crafted HTTP request sent to a site is enough to execute arbitrary commands under the privileges of the PHP process.
The PHP advisory states that all PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed, with the highest risk on mod_php. The advisory also states that there are no complete mitigations and that updating is the only safe choice.
Affected Scope
PHP branch | Affected versions | Fixed version |
8.5.x | Earlier than 8.5.12 | 8.5.12 |
8.4.x | Earlier than 8.4.27 | 8.4.27 |
8.3.x | Earlier than 8.3.36 | 8.3.36 |
8.2.x | Earlier than 8.2.35 | 8.2.35 |
PHP 8.1 and older: The PHP project no longer ships updates for these branches and provides only minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1. Installations using distribution packages should contact the distribution vendor or move to a supported PHP 8 branch.
PHP 8.2: reaches end of life on December 31, 2026 and will receive no further security fixes after that date.
EdgeOne Protection
CVE | EdgeOne coverage | Action |
CVE-2026-109619 | Covered by Managed Rules | Enable Managed Rules with rule IDs 4494969309 |
CVE-2026-109618 | Covered by Managed Rules | Enable Managed Rules with rule IDs 4401216559 Additionally, It is recommended to use custom rules to block unnecessary multipart requests and oversized request bodies |
Blocking CVE-2026-109618 and CVE-2026-109619 with Managed Rules
Requests exploiting this vulnerability must carry the session upload progress field (default field name PHP_SESSION_UPLOAD_PROGRESS). The field does not appear in normal business traffic and cannot be altered without breaking the exploit chain, which makes it a high-discrimination indicator. EdgeOne has released two rules based on this indicator, with rule IDs 4401216559 and 4494969309, categorized under Open Source Component Vulnerabilities. These rules detect and block requests exploiting CVE-2026-109618 and CVE-2026-109619, keeping attack traffic away from the origin server.
Configuration steps:
Disable Evaluation Mode for Managed Rules.
If Automatic Update is enabled, ensure that the Open Source Component Vulnerabilities rule group is set to Automatic Protection (available on the Standard and Enterprise plans) and that its action is set to Block.
If Automatic Update is not enabled, ensure that rule IDs 4401216559 and 4494969309 in the Open Source Component Vulnerabilities rule group are set to Block.
Note:
On sites with Evaluation Mode enabled, or where Open Source Component Vulnerabilities is set to Manual Protection, these rules run in Observation mode. Attack requests are logged but not intercepted.
Further mitigating CVE-2026-109618 with Custom Rules
CVE-2026-109618 is triggered by exhausting PHP process memory. In addition to setting up Managed Rules, Custom rules are recommended to narrow the scope of service exposure, together with a PHP upgrade.
Blocking unnecessary multipart requests
Exploitation of both vulnerabilities happens during multipart request handling. Where certain site paths have no file upload, form submission, or other multipart business traffic, multipart requests to those paths can be blocked outright.
Add a rule under Web Protection > Custom Rules > Precise matching rules:
Match condition: Custom request header, header name Content-Type, operator Contains, value multipart/form-data.
Match condition: Request path (Path), operator Does not equal, value set to the path that actually needs to receive multipart requests, for example /api/upload.
Action: Block.
Blocking oversized request bodies
Triggering memory exhaustion requires the attacker to feed a large volume of data into the PHP process. Where a site has no business scenario that requires large request bodies, an upper limit can be set on request body length, and anything above it blocked.
Add a rule under Web Protection > Custom Rules > Precise matching rules:
Match condition: Request body, operator Length greater than, value 8192 (8 KB).
Action: Block.
Note:
The default maximum request body scan length for an EdgeOne security policy is 10 KB, Please upgrade to Enterprise if your service need to inspect requests over 10KB request body .
Upgrading PHP to a Fixed Version
Please upgrade your PHP services to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. Please also review the memory_limit, post_max_size, and upload_max_filesize settings, to avoid allocating excessive memory or request body limits to a single request.
Note:
Where an immediate upgrade is not possible, setting session.upload_progress.enabled to 0 can be used as a temporary mitigation. This is not a complete fix: CVE-2026-109619 has more than one path that consumes stale state, and disabling upload progress closes only one of them. It does not replace the version upgrade.