Mitigation is in progress, so this quick post was generated with help of Claude Code CLI.
If you run anything on PHP (WordPress, Nextcloud, Matomo, phpMyAdmin, a cPanel box, that old homelab dashboard you forgot about), today is patch day.
Two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), leaked ahead of coordinated disclosure. They can allow remote code execution, possibly without authentication. PHP moved its emergency release up to Wednesday 21 Oct, 14:00 UTC (10:00 AM ET) and has said it may ship earlier if exploitation starts.
Only supported branches get a fix! = PHP 8.2, 8.3, 8.4, 8.5.
8.1, 8.0, 7.x and 5.x are end-of-life and get nothing. If you’re on one of those, upgrading is the fix. Your distro or panel vendor (Remi, CloudLinux/TuxCare, Ubuntu ESM, etc.) may backport on its own schedule, but don’t count on it.
The widely shared mitigation is:
session.upload_progress.enabled = 0
session.use_strict_mode = 1
It’s harmless for most sites, so it’s worth applying. But GMO Flatt expects bypasses, and a PHP core developer put it bluntly: “the only mitigation is patching/upgrading PHP.” Also check that it applies to the SAPI actually serving traffic (FPM/mod_php), not just the CLI:
php-fpm -i | grep -E 'upload_progress.enabled|use_strict_mode'
I manage a few dozen clients servers that this would affect, so last night looked like this:
Today at release: dnf/yum/apt update the PHP packages, reload FPM, confirm php -v everywhere, then watch for PHP workers spawning shells.
php -v on every box, and note any EOL versionssh, curl, wget, etc.
What PHP versions are you still finding in the wild?