Updated, October 23, 2026.
The PHP project has published a note on a bypass of the original fixes. It involves session upload progress and is tracked as CVE-2026-115560. PHP describes the conditions as unusual and will publish a full advisory with its next regular release, so no new patched version is available yet. Keep updating to the versions listed below. The only changes to our guidance are the session upload progress measure in step 3 and the new check in step 4. PHP's note is at https://www.php.net/index.php#2026-10-23-1.
The PHP project released fixes today for two critical vulnerabilities that can allow unauthenticated remote code execution. They are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP rates each 9.2 on CVSS v4.0. If PHP runs anywhere in your environment, please update it today. PHP states that updating is the only safe choice.
These vulnerabilities are bugs in PHP's underlying C code, not in the applications running on it. Contrast does not protect against these vulnerabilities. They are flaws in PHP itself, not in your application. To fix them, install a patched version of PHP.
What to do
- Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, starting with internet-facing systems. This means the PHP runtime itself, since updating an application such as WordPress or Laravel does not patch PHP. Restart PHP-FPM or your web server afterward and confirm the running version.
- If you run PHP 8.1 or older, the PHP project issues no updates for those versions. Upgrade to a fixed version, or ask your vendor about a backported fix.
- If you cannot update today, apply the interim measures PHP lists in its advisory. PHP is clear that they reduce exposure to specific attack paths and do not make an installation safe, so keep the update on the calendar and restrict access to the system until it is done. If you use a web application firewall or CDN, confirm your provider's emergency rules for these CVEs are enabled in block mode, and treat them as an added layer, not a replacement for the update. The measures are below.
- For CVE-2026-109618, set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration. Set a low post_max_size (8M if you do not need uploads, 32M if you do), keep upload_max_filesize below it, and enforce request size, field count, and header limits at your web server or proxy. Use a container or cgroup limit that kills only the affected worker, and do not use RLIMIT_AS or RLIMIT_DATA.
- For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or your FPM pool or server configuration, then restart every worker. Do not rely on ini_set() or .user.ini. On PHP 8.5, also set fatal_error_backtraces=0 and restart. Remove invalid or deprecated per-request settings that emit diagnostics, and fix attacker-reachable fatal errors and execution timeouts. Turning off upload progress also removes a required condition for CVE-2026-115560.
- After you update, check whether any application sets session.serialize_handler to php_binary or php_serialize and later switches it to php with ini_set() before calling session_start(). PHP names that pattern, combined with session upload progress being enabled, as the condition for CVE-2026-115560. If you find it, disable session.upload_progress.enabled or remove the runtime switch until PHP ships its fix. If your applications never change the serialize handler at runtime, no change is needed and upload progress can stay enabled on patched systems.
- Check web server and PHP logs from at least October 20 forward for web server processes starting shells, download tools, or unexpected outbound connections. If you find any, isolate the host and start your incident response process.
PHP's full advisory is at https://www.php.net/archive/2026.php#2026-10-21-5, with a follow-up note at https://www.php.net/index.php#2026-10-23-1.
We have assessed our own environment and have not identified exposure to these vulnerabilities. Our customer-facing platform (both SaaS and On-premises) does not run on PHP. If you use the Contrast PHP agent, it runs inside your own PHP environment, so the update guidance above applies to the hosts where it runs.
Questions? Go to your account manager or support@contrastsecurity.com.