Two critical Remote Code Execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, are scheduled for disclosure before a fix is available to organizations. JFrog is closely monitoring these vulnerabilities and will share information here to help security teams identify exposed systems and prepare to patch.

On October 20, the PHP security team announced an upcoming security release scheduled for October 21 at 14:00 UTC. The release is expected to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each assigned a CVSS v4.0 score of 9.2.

The timing creates a difficult situation for defenders. Organizations have been warned about critical vulnerabilities in one of the web's most widely deployed server-side technologies, but the official technical details and fixed versions have not yet been published. Meanwhile, researchers have been investigating the issues, and reports of a potential exploit have already emerged.

The vulnerabilities have been associated with the name PHP2Shell, reflecting their reported remote code execution impact. If successfully exploited, such flaws could allow an attacker to execute commands on a vulnerable web server, potentially leading to server compromise, data theft, or further access into the affected environment.

Organizations should avoid assuming that the absence of observed attacks means they are safe. At the time of writing, public reporting had not established widespread exploitation in the wild. That status can change quickly once technical details or reliable exploit code become available.

What organizations should do now

This is not a situation where security teams can wait for the usual vulnerability management cycle to run its course. They need to identify their PHP footprint now and be ready to apply the fix as soon as it becomes available.

Until the fixed PHP releases become available, security teams should focus on reducing exposure and preparing for rapid remediation.

1. Inventory every PHP deployment

Identify PHP installations across internet-facing web servers, application servers, containers, hosting environments, and bundled third-party products. Include platforms such as WordPress, Drupal, Joomla, and Magento, as well as software that embeds PHP without making it obvious.

Do not rely solely on application dependency inventories. PHP is a runtime-level component, so the relevant inventory must include the actual runtime deployed on each host.

2. Upgrade to PHP 8.2+ and prepare to patch immediately

Monitor the official PHP security announcements for the fixed versions and technical details. Prepare the necessary change approvals and testing procedures in advance, prioritizing internet-facing systems.

A patch for CVE-2026-109618 and CVE-2026-109619 may not be available for unsupported PHP versions (8.1 and earlier). If you are running these versions, you should upgrade to a supported PHP version (8.2 or later) ahead of time. This can simplify the remediation process once the CVE patches are available.

Organizations using Linux distributions, managed hosting, or container images should also check their respective vendors for updated packages and prepare the latest version ahead of time. Vendors may backport security fixes without changing the upstream version number as expected, so verify patch status against the relevant vendor advisory.

3. Consider temporary mitigations

While waiting for the official fixes, administrators can consider a temporary mitigation: disabling PHP's session upload-progress feature by setting the following directive in the applicable PHP configuration:
session.upload_progress.enabled = Off

This setting disables PHP's session upload-progress functionality, which has been identified in community research as a potential part of the PHP2Shell attack path. However, we are still verifying whether this mitigation addresses all attack vectors associated with CVE-2026-109618 and CVE-2026-109619.

How Can JFrog Help?

JFrog is tracking both vulnerabilities and helping organizations prepare to respond.

JFrog Xray and Catalog already includes CVE-2026-109618 and CVE-2026-109619 in its vulnerability intelligence, helping teams identify these issues through their existing security workflows.

In parallel, the JFrog Security Research team is developing dedicated contextual scanners for both CVEs in JFrog Advanced Security (JAS). The scanners will provide additional detection capabilities for these vulnerabilities and will be available soon.

As more technical details become available, we will continue to investigate the vulnerabilities and update our detection capabilities to help organizations assess their exposure and respond quickly.

IoCs

JFrog XRAY IDs