PHP developers announced the release today at 17:00 (MSK) of urgent patch versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) that will address two critical vulnerabilities. All server administrators using PHP are strongly advised to promptly install these patches on their systems as soon as they are released. Official details will only be disclosed after the patches are available, but based on publicly available information, the vulnerabilities in question are CVE-2026-109618 and CVE-2026-109619, which potentially allow remote code execution on any web server running PHP scripts in default configuration. The issues affect all versions starting from PHP 5.4.
Prototypes of exploits (1, 2) have already appeared online to check systems for vulnerability exposure. The note accompanying the exploit states that the vulnerabilities are caused by accessing already freed memory in the file upload progress tracking handler. server (session.upload_progress). Having file upload functionality on the website for conducting an attack is not required; it is enough for the PHP interpreter to automatically trigger the 'multipart/form-data' content handler. For successful exploitation, the layout of structures in the process memory, which is specific to each build, must be determined (this issue is addressed by iterating through offsets in the exploit, pre-calculated for packages from different distributions).
As a workaround for the protection, recommendations are sometimes provided to set the parameter in php.ini to 'session.upload_progress.enabled = off' (or 'php_admin_flag[session.upload_progress.enabled] = off' in PHP-FPM), but a representative of the PHP project, as well as the author of the first exploit prototype, claim that this is insufficient to block both vulnerabilities. The note to the second exploit prototype mentions that, in addition to the aforementioned setting in php.ini, to prevent the attack without applying a patch, a complete blocking of requests with the content type 'multipart/form-data' is required, which would render file uploads through web forms impossible.
In Apache httpd, to block multipart requests, the following rule can be used in mod_rewrite:
RewriteCond %{HTTP:Content-Type} multipart [NC]
RewriteRule ^ — [F,L]
To block in nginx:
if ($http_content_type ~* 'multipart') {
return 403;
}
To block in Caddy:
@multipart header_regexp Content-Type (?i)multipart
respond @multipart 403
Supplement: Corrective releases of PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 have been published, along with details about fixed critical vulnerabilities. An analysis of the vulnerabilities and officially recommended workarounds for protection has been published in a separate news article.
Source: opennet.ru
