Critical PHP Vulnerabilities: Temporary Mitigation

-
Announcements
Security

Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been reported in PHP, with potential for remote code execution. Vulnerabilities are weaknesses in software that attackers can exploit to compromise systems and execute malicious code.

As of 21 October 2026, 16:00, technical information remains limited. Possible Security provides the following interim mitigation recommendations for Apache2 with PHP running as module. They can be adapted for other web servers by readers familiar with their server's configuration. Apply official security patches as soon as they become available.

1. Test before applying the mitigation

Run these commands against your affected website, replacing https://your-host/ with your target URL:

curl -X POST -H 'Content-Type: multIpart/form-data; boundary=----PS' https://your-host/
curl -X GET -H 'Content-Type: multIpart/form-data; boundary=----PS' https://your-host/

Record the responses for comparison after applying the mitigation.

2. Identify PHP configurations and their limits

Find the relevant PHP settings:

grep -R -e memory_limit -e post_max_size /etc/

Note the maximum configured post_max_size.

3. Configure Apache2

Add the following to httpd.conf, adjusting post_max_size to the maximum identified above and setting memory_limit to ten times that value. If this would exceed available memory, reduce post_max_size to one-tenth of memory_limit. Ensure that upload_max_filesize is smaller than post_max_size.

php_admin_flag session.upload_progress.enabled Off
php_admin_flag session.upload_progress.cleanup Off
php_admin_value max_input_nesting_level 6
php_admin_value post_max_size 20M
php_admin_value upload_max_filesize 19M
php_admin_value memory_limit 200M

<Location "/">
    <If "req('Content-Type') =~ /(?i)^multipart/">
        Require all denied
    </If>
</Location>

The 20M and 200M values are examples; use values appropriate for your environment.

Warning: The Apache rule blocks all requests with a multipart Content-Type header at the specified location. This will break file uploads and may affect other multipart functionality.

4. Update php.ini

Add or update the corresponding PHP settings in the applicable php.ini file, using the same limits selected above:

session.upload_progress.enabled = Off
session.upload_progress.cleanup = Off
max_input_nesting_level = 6
post_max_size = 20M
memory_limit = 200M

Ensure you update the configuration used by the relevant PHP runtime, such as PHP-FPM or mod_php.

5. Validate and restart Apache2

Run a configuration test and restart Apache:

apachectl configtest && systemctl restart apache2

A restart is required; do not simply reload Apache.

6. Test again

Repeat the two curl commands from step 1 and compare the results. Confirm that multipart requests are blocked as intended and verify that normal website functionality remains operational.

These are temporary defensive measures, not a substitute for an official fix. Monitor PHP security advisories and apply patched versions as soon as possible.

News