Help CenterOn Wednesday, October 21, 2026, PHP released security updates addressing two critical vulnerabilities. PHP is commonly used for building websites and web applications, including retrieving and updating database data, handling API requests, processing login requests and forms, and more. As an estimated 70% of websites with an identifiable server-side programming language use PHP, these vulnerabilities could put a significant number of web servers at risk of unauthorized code execution. ThreatLocker was unaffected by these vulnerabilities, as our internal infrastructure does NOT use PHP.
CVE-2026-109618 states that the vulnerability could allow attackers to execute code by exploiting a memory corruption issue during out-of-memory handling. If PHP were to reach the configured memory limit at a particular point during request processing, internal data may remain partially initialized, potentially causing that data to be treated as valid. This use of incomplete data could corrupt the memory, allowing an attacker to execute code. To view more about this vulnerability, please refer to the following link: CVE Record: CVE-2026-109618
CVE-2026-109619 states that the vulnerability could allow attackers to execute code by exploiting a freed memory issue. An error could leave PHP holding references to memory that had already been freed. A request processed by the same worker could access that invalid memory, allowing an attacker to execute code. To view more about this vulnerability, please refer to the following link: CVE Record: CVE-2026-109619
To protect against these vulnerabilities, if you have a PHP-based website or application, ensure the PHP installation is updated immediately. The fixes were released on October 21, 2026, and are available for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
In addition, ThreatLocker recommends using our PHP 8.2, 8.3, 8.4, and 8.5 Vulnerable Versions Built-Ins to block or restrict vulnerable PHP versions in your environment, or using the PHP All Versions Built-In to deny it entirely. By using Application Allowlisting, PHP can be denied in your environment. Additionally, on Windows, Ringfencing policies can be applied to restrict the files, child processes, and network resources available to affected application workflows. As PHP is widely embedded across many products and services, any policies should be carefully tailored and tested to the needs of your environment.
On Friday, October 23, 2026, PHP released an Informational Advisory regarding the session.upload_progress.enabled configuration directive, which controls file upload progress tracking. A potential remote code execution vulnerability can occur if an application is configured to use php_binary or php_serialize, switches to php at runtime before starting the session, and has session upload progress enabled. To mitigate this issue, PHP recommends setting session.upload_progress.enabled=0 until the next regular bugfix release. This combination of configuration and application behavior is uncommon. PHP is tracking the issue under CVE-2026-115560 and will publish a full advisory with its next release.
Please Note: If you have applications that never change their serialization format at runtime, PHP advises that
session.upload_progress.enabledcan remain enabled.
For more information from PHP about the above vulnerabilities, please refer to the following link: PHP: News Archive - 2026