PHP - RCE (CVE-2026-109619)

CVE-2026-109619 is a critical use-after-free vulnerability in PHP core, rated 9.2 on CVSS v4.0 by the PHP security team. Request-owned state that survives a fatal error in a persistent worker is consumed by the next request before normal initialization, notably by the session upload progress handler, which is enabled by default and needs no session_start() call. An unauthenticated attacker can chain a producing and a consuming request on the same worker to execute arbitrary code as the web server user, on both Apache mod_php and PHP-FPM. It is disclosed together with CVE-2026-109618 under the name "php2shell".

CrowdSec has been tracking this vulnerability and its exploits since 21st of October 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-109619 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2026-109619 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers send multipart/form-data POST requests to any PHP endpoint (commonly /index.php) containing a PHP_SESSION_UPLOAD_PROGRESS form field alongside an attacker-chosen PHPSESSID supplied in the POST body or the Cookie header, with or without a file part. Detection should focus on the PHP_SESSION_UPLOAD_PROGRESS field name in a multipart request body.