Critical vulnerabilities in PHP that could lead to remote code execution

According to leaks online vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow remotely execute any PHP script on any web server that is using PHP knowing just the layout of PHP structures in the memory.

All PHP versions starting with 5.4 are exposed to these vulnerabilities!

Upcoming critical PHP security release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

Do not use any third-party solutions to remediate the vulnerabilities!

For now there is a simple workaround to mitigate the exposure before patching the PHP on your server:

Add the following string into php.ini for each PHP version you have on the server:
```
session.upload_progress.enabled = off
```
In terms of the PHP-FPM add the following string into php.ini for each PHP-FPM version you have on the server:
```
php_admin_flag[session.upload_progress.enabled] = off
```

Block any multipart uploads in the web server by adding following rewrite rule:

if ($http_content_type ~* "multipart") {
return 403;
}

RewriteCond %{HTTP:Content-Type} multipart [NC]
RewriteRule ^ - [F,L]

@multipart header_regexp Content-Type (?i)multipart
respond @multipart 403

Restart the web server:

systemctl nginx restart

Debian-based systems:

systmectl apache2 restart

RHEL-based systems:

systmectl httpd restart

systemctl caddy restart