Upcoming critical PHP security release (CVE-2026-109618 / -109619)
Points and comments are a snapshot, not live.
An upcoming critical PHP security release addresses vulnerabilities (CVE-2026-109618 and -109619) affecting versions 5 through 8.
The PHP announcement page was unavailable (502 Bad Gateway) at the time of fetching, so no article body could be retrieved. The title and comments indicate that two critical vulnerabilities (CVE-2026-109618 and -109619) will be patched in an upcoming release.
What commenters are saying
Commenters widely regard this as a catastrophic, easily exploitable remote code execution vulnerability affecting all PHP versions from 5 onward, possibly worse than Log4Shell. A proof-of-concept is reportedly circulating privately and on Twitter, showing arbitrary shell access from a POST request. Mitigations suggested by users include disabling session.upload_progress.enabled and blocking multipart requests, but a PHP core dev has indicated these are insufficient. Many commenters advocate shutting down servers immediately until the patch is released, citing the exploit's severity and the risk of automated attacks.