GoKawiilTwo new PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619
Security researchers have disclosed two PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP web runtimes, along with a suggested AWS WAF rule named 'PHP2Shell' to help block exploitation attempts. The rule targets POST requests that combine PHPSESSID cookie or body values with the PHP_SESSION_UPLOAD_PROGRESS parameter, a pattern associated with session-based remote code execution attacks against PHP applications.
GoKawiil's interpretation of the reporting above, not reported fact.
The published WAF rule suggests the vulnerabilities relate to PHP's session upload progress feature, which has historically been exploited to achieve remote code execution via crafted multipart requests. Organizations running PHP-based web applications may need to apply patches once available and consider deploying mitigating firewall rules like the one shared in the meantime. The naming 'PHP2Shell' implies the flaws could allow attackers to escalate from a web request to shell-level code execution if left unaddressed.
- Two PHP CVEs, 2026-109618 and 2026-109619, have been identified affecting PHP web runtimes.
- A proposed AWS WAF rule blocks POST requests combining PHPSESSID with PHP_SESSION_UPLOAD_PROGRESS to mitigate exploitation.
- The attack pattern resembles known PHP session upload progress exploits that can lead to remote code execution.
Source: aws.amazon.com, 2026-10-21
Published there as: “PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.