In an Oct. 23 notice, PHP urged operators to switch off upload-progress tracking after warning that a specific sequence of session-handler changes can create a remote code execution path in some configurations.
The notice ties the risk to a specific sequence: an application sets session.serialize_handler to php_binary or php_serialize, then uses ini_set() to switch to php before session_start(), while upload progress stays enabled. PHP calls this configuration unlikely and says the notice does not make every PHP site vulnerable.
PHP’s new notice came two days after its Oct. 21 patches for CVE-2026-109618 and CVE-2026-109619. Released at 10 a.m. ET (14:00 UTC), those fixes covered PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities were rated 9.2 out of 10 under CVSS v4.0. EconoTimes previously covered the Oct. 21 PHP security updates.
PHP recommends setting session.upload_progress.enabled to 0 as a workaround pending its next routine bug-fix release.
