PHP - RCE (CVE-2026-109618)

CVE-2026-109618 is a critical use-after-free vulnerability in PHP's session upload progress handler, rated 9.2 on CVSS v4.0 by the PHP security team. Since the upload progress feature is enabled in a default configuration, an unauthenticated attacker can trigger the freed memory reuse with a single crafted multipart upload request and potentially execute arbitrary code as the web server user. It is disclosed together with CVE-2026-109619 under the name "php2shell".

CrowdSec has been tracking this vulnerability and its exploits since 21st of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-109618 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send multipart/form-data POST requests to any PHP endpoint (commonly /index.php) containing a PHP_SESSION_UPLOAD_PROGRESS form field alongside an attacker-chosen PHPSESSID supplied in the POST body or the Cookie header, plus a file part whose filename carries the payload. Detection should focus on the PHP_SESSION_UPLOAD_PROGRESS field name in a multipart body combined with a client-supplied session identifier, and on filenames containing PHP tags, pipe characters or serialized-object syntax.