PHP session.upload_progress heap UAF (CVE-2026-109618/-109619)

Wed, 21 Oct 2026 15:56:43 +0000

Engineer — Act: Heap UAF in PHP’s session.upload_progress with a public PoC on GitHub creates immediate RCE risk on any internet-facing PHP stack; patch PHP to the fixed release now, or disable session.upload_progress in php.ini if the feature is unused.
SOC/IR — Plan: A working PoC is public but mass exploitation isn’t confirmed yet — build detections for anomalous POST requests targeting session.upload_progress endpoints and tune WAF rules this sprint before an exploitation wave arrives.
Leader — Skip
Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub, reported by 4 collected sources

Heap-Uaf on CuraSec