# Critical PHP flaw hits all versions, exploited

Published: 2026-10-21 · Severity: high · Sectors: Technology
Canonical: https://vorant.io/reports/9a7f3be9-6adc-51a0-ab2e-15e4e3747896/critical-php-flaw-hits-all-versions-exploited

> A critical PHP core vulnerability (CVSS 9.4) affects all PHP versions and is already being exploited, with a patch for PHP 8 pending.

SANS ISC raised its InfoCon to YELLOW after PHP.net announced an imminent critical security release addressing two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.4. The flaw resides in PHP core and affects all PHP installations starting from PHP 5 through current releases by default configuration. Only PHP 8 is expected to receive an official patch since older branches are end-of-life and unsupported, leaving a large population of legacy PHP deployments permanently exposed.

At the time of writing, Cloudflare and independent researcher jackalsyn had already published proof-of-concept details and reported exploitation attempts in the wild, ahead of the vendor patch (expected 14:00 UTC, October 21). Full technical details of the vulnerability were still emerging, but SANS noted that default PHP configurations are vulnerable with no special extension or configuration required to trigger exploitation.

As an interim mitigation, early guidance recommends setting session.upload_progress.enabled = Off, since this setting is On by default and appears to provide partial protection against exploitation. Some CDN/WAF providers, including Cloudflare, have already deployed detection/blocking rules, and other vendors are expected to follow. Given the ubiquity of PHP across web applications, defenders should prioritize monitoring PHP.net advisories, apply the patch as soon as it is released, and apply the configuration mitigation immediately while awaiting the fix.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618, CVE-2026-109619

## Detection guidance (public sample)

### PHP or Web Server Process Spawning Shell With Recon or Download Commands (Linux)

ATT&CK: T1190

A PHP handler or web server (php-fpm, php-cgi, apache, httpd) spawns a shell that runs recon, download-and-execute or reverse-shell commands. This is typical post-exploitation after a PHP RCE such as the unpatched PHP core flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP or Web Server Process Spawning Shell With Recon or Download Commands (Linux)
description: Detects PHP handlers or web server processes (php-fpm, php-cgi, apache2,
  httpd) spawning a shell that runs recon, payload download or reverse-shell commands.
  Generalises post-exploitation of a PHP remote code execution flaw, not a specific
  payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /php-fpm
    - /php-cgi
    - /apache2
    - /httpd
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - whoami
    - 'curl '
    - 'wget '
    - /dev/tcp/
    - nc -e
    - base64 -d
    - chmod +x
    - /etc/passwd
    - python -c
    - perl -e
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Web applications that intentionally shell out to curl or wget from PHP for updates
  or health checks
- Administrative web panels that run system commands
level: high
id: 99690fd4-78b8-5ff6-86d2-1dbed7fcc044
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33440
```

### PHP CGI or Web Server Process Spawning Command Interpreter With Suspicious Arguments (Windows)

ATT&CK: T1190

php-cgi.exe, httpd.exe or w3wp.exe spawning cmd, PowerShell or a LOLBin with recon or download arguments, indicating web shell or RCE exploitation of a PHP application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP CGI or Web Server Process Spawning Command Interpreter With Suspicious
  Arguments (Windows)
description: Detects PHP CGI or web server worker processes spawning cmd, PowerShell
  or download LOLBins with recon or download arguments. Indicates post-exploitation
  of a public-facing PHP application.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \php-cgi.exe
    - \httpd.exe
    - \w3wp.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
  selection_cmd:
    CommandLine|contains:
    - whoami
    - net user
    - net localgroup
    - urlcache
    - -enc
    - downloadstring
    - Invoke-WebRequest
    - ipconfig /all
    - systeminfo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Web-based admin tools that legitimately run systeminfo or ipconfig from PHP
- Vulnerability scanners run with authenticated command execution against the server
level: high
id: 3c0b6903-ba8b-5586-b53a-e2f250d75cdd
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33440
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33440

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9a7f3be9-6adc-51a0-ab2e-15e4e3747896/critical-php-flaw-hits-all-versions-exploited.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup