# CVE-2026-109618: PHP - RCE

> Live exploitation tracking for CVE-2026-109618 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-109618

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **Public exploit available:** Yes
- **Affected products:** PHP
- **Weaknesses:** CWE-416 (Use After Free)
- **Tags:** php

## Description

PHP contains a use-after-free vulnerability in the session upload progress handler. Because session.upload_progress.enabled is on by default, an unauthenticated remote attacker can reach the vulnerable path with a crafted multipart/form-data POST request carrying a PHP_SESSION_UPLOAD_PROGRESS field and an attacker-controlled session identifier, leading to memory corruption and potentially remote code execution as the web server user. Disclosed publicly as "php2shell" together with CVE-2026-109619.

## CrowdSec analysis

[CVE-2026-109618](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-109618) is a critical use-after-free vulnerability in PHP's session upload progress handler, rated 9.2 on CVSS v4.0 by the PHP security team. Since the upload progress feature is enabled in a default configuration, an unauthenticated attacker can trigger the freed memory reuse with a single crafted multipart upload request and potentially execute arbitrary code as the web server user. It is disclosed together with CVE-2026-109619 under the name "php2shell".

CrowdSec has been tracking this vulnerability and its exploits since 21st of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-109618 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers send multipart/form-data POST requests to any PHP endpoint (commonly `/index.php`) containing a `PHP_SESSION_UPLOAD_PROGRESS` form field alongside an attacker-chosen `PHPSESSID` supplied in the POST body or the Cookie header, plus a file part whose filename carries the payload. Detection should focus on the `PHP_SESSION_UPLOAD_PROGRESS` field name in a multipart body combined with a client-supplied session identifier, and on filenames containing PHP tags, pipe characters or serialized-object syntax.

## Timeline

- 2026-10-21: CVE Published. CVE-2026-109618 is published to NVD.
- 2026-10-21: Rule Released. CrowdSec releases a rule to detect CVE-2026-109618 exploitation attempts against the CrowdSec Network.
- 2026-10-21: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-109618 for the first time.

## References

- https://www.upwind.io/feed/initial-assessment-php2shell-two-critical-unpatched-php-rces-cve-2026-109618-cve-2026-109619
- https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/
- https://github.com/ikow/php2shell-poc/blob/main/poc/verify_session_injection.py
- https://github.com/xuehuolll/CVE-2026-109618-109619-audit

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-109618) follows observed exploitation activity for CVE-2026-109618. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.