PHP2Shell Patches Drop at 14:00 UTC; Workarounds Proven Inadequate

Key points

• PHP will release fixes for CVE-2026-109618 and CVE-2026-109619 at 14:00 UTC on October 21, 2026.
• The vulnerabilities are rated 9.2 out of 10 on the CVSS v4.0 scale and allow remote code execution.
• No active exploitation has been confirmed as of October 21, but experts warn attacks may start within 15 minutes of the patch release.
• The widely circulated workaround, disabling session.upload_progress.enabled, is not a complete fix and may be bypassed.
• Only PHP versions 8.2 through 8.5 will receive official fixes; older end-of-life versions remain unpatched.
• Administrators should isolate internet-facing PHP applications or restrict access until patches are applied.

Background

The PHP security team originally planned to disclose these vulnerabilities on October 22 but accelerated the release to October 21 after details leaked online. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were identified as critical remote code execution bugs in PHP core. Prior coverage indicated that the premature disclosure prompted the shift in timeline to mitigate risks from the leaked information, with security firms urging administrators to prepare maintenance windows and backups.

How outlets are covering it

GMO Flatt Security initially suggested disabling session.upload_progress.enabled as a mitigation but later walked back this advice, stating it is not a complete fix and that attacks bypassing it are expected. PHP core developer Gina Peter Banyard emphasized that patching is the only reliable mitigation. watchTowr confirmed the vulnerabilities are real but noted no confirmed patch or workaround exists at this time. Sansec warned that mass attacks could start within 15 minutes of the patch release. Upwind still lists the session upload progress setting as an immediate mitigation, citing another researcher's analysis. An anonymous code audit argues the specific bug described in Session Upload Progress does not exist in released PHP, contradicting the workaround's premise. Ars Technica reported that a leaked video showed the exploit tool PHP2Shell executing code on various web applications, including WordPress and Magento, though the report's authenticity is unconfirmed. CERT-EU advised isolating internet-facing applications from public networks until fixes are applied.

Why it matters

PHP powers a significant portion of the web, including major content management systems and web applications. Critical remote code execution vulnerabilities in PHP core pose a severe risk to internet-facing systems, potentially allowing attackers to take over servers. The lack of a reliable workaround prior to the patch release means organizations must act quickly to mitigate risk. The accelerated timeline and warnings of imminent mass exploitation highlight the urgency of updating PHP systems to prevent widespread compromise.

What to watch

PHP maintainers will release the patches at 14:00 UTC on October 21, 2026, with details on affected versions and fixed releases to follow. Administrators should monitor php.net and PHP's GitHub security advisories for updates. After patching, organizations should review logs for any pre-patch exploitation attempts. For those unable to patch immediately, isolating or restricting access to PHP applications is recommended. Hosting providers and Linux distributions may backport fixes for unsupported versions on their own schedules.