The PHP development team has announced an upcoming security update to address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 under CVSS v4.0. According to CERT-EU, these vulnerabilities may allow unauthenticated remote code execution under certain exploitation conditions, potentially exposing website files and data within the privileges of the PHP process. CERT-EU Security Advisory.

The advisory concerns the PHP runtime environment used by websites and applications. At the time of publication, the PHP development team has not yet released complete technical details or a definitive list of affected and patched versions. The security update is scheduled for October 21, 2026, at 5:00 PM Baghdad time (14:00 UTC), with the possibility of an earlier release. Official PHP Announcement.

What Does This Mean for IQ Hosting Customers?

For shared hosting customers, our technical team is responsible for monitoring security developments and applying the necessary server-level security patches as soon as they become available from the relevant vendors. Customers do not need to update PHP at the server level themselves.

For customers using unmanaged Virtual Private Servers (VPS) or dedicated servers, reviewing PHP configurations, implementing protective measures, and installing security updates remain the responsibility of the server administrators.

Temporary Protection Measures

Until the security updates become available and are installed, we recommend that website and server administrators take the following precautions:

1. Temporarily Disable PHP Upload Progress Tracking

   Available research suggests that this feature is associated with one of the potential exploitation paths. It can be disabled by modifying the PHP configuration using the appropriate syntax for the configuration file:

   In php.ini or .user.ini files:

   session.upload_progress.enabled = Off

   In PHP-FPM pool configuration (.conf) files:

   php_admin_flag[session.upload_progress.enabled] = off

   The setting should be applied to all PHP environments actively in use. Reload the appropriate service when necessary, then verify that the effective setting is Off within the website's PHP runtime environment.

   This setting disables PHP's built-in upload progress tracking feature. It does not disable file uploads or login sessions, but it may affect upload progress indicators that depend on this functionality. PHP Documentation.

2. Use a Web Application Firewall as an Additional Protection Layer

   ModSecurity rules or other Web Application Firewall (WAF) solutions may help block requests associated with known exploitation paths. Their effectiveness depends on properly configured request body inspection, handling of parsing errors, and inspection limits. Successfully blocking a test request does not guarantee protection against all exploitation methods.

3. Install Security Updates as Soon as They Become Available

   Administrators should monitor PHP packages provided by their control panel vendors or operating system distributors and update all PHP versions actively used by their websites. Updating website applications or plugins alone does not replace the need to update PHP.

These measures temporarily reduce risk but do not replace the required security updates. Researchers are still evaluating whether disabling PHP upload progress tracking mitigates all exploitation paths associated with both vulnerabilities. JFrog Security Analysis.