Two Critical RCEs in PHP: CVE-2026-109618 and CVE-2026-109619

The PHP security team released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both flaws carry a CVSS v4.0 rating of 9.2 and enable unauthenticated remote code execution (RCE). These bugs involve a heap use-after-free in session.upload_progress, a feature enabled by default in many deployments. A proof-of-concept called PHP2Shell demonstrates the exploit chain. Affected versions include PHP 8.2 through 8.5, as well as versions 8.1 and below.