AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026

Reporting by Canadian Centre for Cyber Security AlertsRead the original at cyber.gc.ca

Executive Summary

The Canadian Centre for Cyber Security has issued an alert regarding critical vulnerabilities in PHP, specifically Use After Free flaws tracked as CVE-2026-109618 and CVE-2026-109619, known as "php2shell." These vulnerabilities affect multiple versions of PHP and pose a risk of allowing unauthenticated threat actors to execute arbitrary code on affected systems. The alert notes that internet-facing PHP servers are particularly at risk. A separate vulnerability, CVE-2026-115560, was also announced, which requires an uncommon configuration combination to exploit and is not addressed by the initial security updates. To mitigate the risks from the initial vulnerabilities, organizations must immediately update affected systems to specific fixed versions, such as PHP 8.5.12 for 8.5.x prior to 8.5.12, or corresponding fixes for other major versions. An interim mitigation recommended for CVE-2026-115560 is disabling the session upload progress feature:session.uploadprogress.enabled=0. Open-source reporting suggests that the initial vulnerabilities are currently being exploited in the wild, as indicated by CISA adding them to the Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre strongly advises organizations to update systems, prioritize internet-facing assets, and monitor logs for suspicious activity.

Facts Only

* Vulnerabilities CVE-2026-109618 and CVE-2026-109619 are Use After Free vulnerabilities (CWE-416) affecting multiple PHP versions, known as "php2shell."
* Successful exploitation allows an unauthenticated threat actor to execute arbitrary code on an affected system.
* Internet-facing PHP servers and applications are at heightened risk.
* The PHP Security Team released security updates for these vulnerabilities on October 21, 2026.
* CVE-2026-115560 is another remote code execution vulnerability not addressed by the initial updates.
* Exploitation of CVE-2026-115560 requires an uncommon combination of PHP configuration and application behavior, specifically requiring the serialization handler to not change at runtime.
* The PHP Security Team recommends disabling the session upload progress feature:session.uploadprogress.enabled=0 as a mitigation for CVE-2026-115560.
* Open-source reporting indicates that CVE-2026-109618 and CVE-2026-109619 are being exploited in the wild.
* CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities (KEV) Database on October 26, 2026.
* Recommended fixed versions include PHP 8.5.12 for 8.5.x prior to 8.5.12, PHP 8.4.27 for 8.4.x prior to 8.4.27, PHP 8.3.36 for 8.3.x prior to 8.3.36, and PHP 8.2.35 for 8.2.x prior to 8.2.35.
* Organizations should update affected installations immediately and prioritize internet-facing systems.

Full Take

The pattern observed is the deployment of high-severity vulnerability notifications that rapidly pivot between initial awareness, specific technical details, and urgent remediation steps based on evolving threat intelligence—specifically tracking exploits in the wild (CISA KEV listing) while layering on subsequent, less understood vulnerabilities. This structure forces an immediate shift from abstract risk awareness to concrete, version-specific action, which is a mechanism designed to trigger rapid organizational response under pressure. The inclusion of both immediately patchable flaws and more esoteric configuration-dependent issues suggests a layered approach where broad patching addresses known exploitation channels while specific advice attempts to cover residual, complex attack vectors. The shift from general risk to specific version mandates and the immediate call to action for internet-facing systems demonstrates an attempt to weaponize urgency to drive compliance with patching protocols. The implicit assumption driving this structure is that organizations will prioritize immediate remediation when faced with publicly documented evidence of active exploitation. What are the long-term implications if systems that cannot be immediately patched remain exposed, and how does the focus on "internet-facing" assets shape the perceived distribution of risk among internal infrastructure?
Bridge Questions: If an organization successfully patches all identified PHP vulnerabilities but fails to address the underlying systemic issues that allow for configuration-dependent exploits like CVE-2026-115560, what is the resulting security posture? How can organizations build a resilient monitoring strategy that anticipates exploitation of unknown or context-specific flaws before official advisories are issued? What is the true cost-benefit analysis of isolation versus immediate patching for systems that cannot be instantly taken offline?

From the original · Canadian Centre for Cyber Security Alerts

Number: AL26-026 Date: October 21, 2026 Updated: October 27, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients.

Read the full story at cyber.gc.ca

Sentinel unavailable

The automated check of the source article's wording did not complete, so no result is shown.

This looks only at the wording of the original source article, not at this page's AI-written sections. A small local AI model made this estimate. It has not been checked against known human and machine texts, so treat it as provisional. It cannot show who wrote an article.