Is your website at risk? What you need to know about the new PHP vulnerabilities

Arbitrary Code Execution

The main issue with these vulnerabilities is that an attacker can execute any code they want on your server if the flaws are exploited. At this moment, there are no known examples of companies directly impacted, but Amazon Web Services published a post showing that exploitation attempts were occurring even before these vulnerabilities were made public. These exploits were identified on honeypot systems, which are traps intentionally set up to monitor how vulnerabilities are targeted.

AWS also posted a list of protective steps, which is included later in this article.

The vulnerabilities exist in the session system, specifically within session.upload_progress. Because of this, prevention is relatively straightforward (even if inconvenient), and official remediation patches are already available.

Impacted Companies

Currently, there are no public reports of companies directly compromised by these vulnerabilities. However, to stay protected, many businesses have chosen to temporarily take down their websites or disable specific features, particularly forms using multipart/form-data.

If you would like to learn more about the technical aspects and how these vulnerabilities are exploited, you can read this post published by ELLIO.

Official Patches

For companies running websites on PHP 8.2 or newer, official patches have already resolved this issue. However, as we well know, a large portion of PHP applications still run on older versions. This includes custom legacy systems and popular CMS platforms like WordPress, PrestaShop, Joomla, and others.

For these legacy setups, upgrading the PHP version is often difficult and, in many cases, quite expensive.

Here is the list recommended by AWS for actions you can take to keep your website secure:

1. Upgrade immediately to the fixed PHP versions. Upgrading is the only complete remediation for both CVE-2026-109618 and CVE-2026-109619. There are no configuration-only workarounds that fully address both issues.
2. Consider blocking multipart file uploads in PHP deployments that cannot be patched or upgraded immediately, but evaluate how this would affect your application prior to deploying the measure.
3. Look for POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string in form uploads.
4. Review web server logs to identify suspicious activity.
5. Check for unexpected process execution or unauthorized file modifications on web application servers.
6. For legacy systems, consider removing or temporarily disabling multipart/form-data forms.

If upgrading to a newer PHP version is not immediately feasible, the preventive measures listed above remain valid mitigation steps.

The PHP Foundation will not provide official support for unmaintained versions (older than PHP 8.2), but commercial support vendors like Zend and third-party maintainers like Ondřej Surý have already released security patches.

What Does This Mean for You?

Upgrading your PHP version remains the single best way to protect yourself. Given that most PHP applications run on shared hosting environments, there is a chance providers will roll out fixes for older versions using third-party patches (such as those from Ondřej Surý), but you cannot rely solely on that.

For those on shared hosting, chances are that official updates for PHP 8.2, 8.3, 8.4, and 8.5 are already available, but you should verify by contacting your host.

For those running custom hosting environments, updates must be performed manually.

Since the issue has already been resolved in officially supported PHP versions, the ultimate recommendation remains upgrading. The reality is that if you run an online store still sitting on old PHP versions like 5.X or 7.X, that upgrade was long overdue anyway, and the cost of migrating or rebuilding a presentation site or blog is at its lowest in years. For internal systems, things are a bit more nuanced, as they can be isolated and protected much more easily.

From my perspective, application maintenance across any programming language will become far more critical in the coming years. The rate of vulnerability discovery is set to increase significantly with the help of AI, which is something you should definitely account for when planning your next project.