PHP CVE-2026-109618 and CVE-2026-109619 reportedly surfaced before patches
SecurityUnverifiedUpdated:
An unverified account says early attacks are emerging around two PHP vulnerabilities disclosed ahead of patches, with patching described as the only confirmed mitigation.
Temporary mitigations untested against the real exploit
The account says two PHP core vulnerabilities were leaked before patches were released and that early attacks had begun to emerge. It says disabling session upload progress and blocking multipart requests may reduce risk in some cases, but neither measure is confirmed to stop the real exploit. It attributes the only confirmed fix to an updated PHP release.
The available account does not establish a before-to-now comparison of exposure or confirmed exploitation.
The account says details of CVE-2026-109618 and CVE-2026-109619 circulated before patches, while it identifies a patched PHP release as the only confirmed fix. It also says potential interim measures have not been proven against the actual exploit.
The confirmed fix is an updated PHP release
If accurate, the reported gap between disclosure and a confirmed fix would leave PHP operators weighing unproven temporary controls while awaiting patched releases.
Sources
- Hacker NewsPHP CVE's: early mitigation stepsRead source →