php_uploadprogress_guard: virtual patch for php2shell CVEs

Thu, 22 Oct 2026 15:52:23 +0000

Engineer — Plan: Public PoCs exist for CVE-2026-109618/109619 but EPSS is low (0.05/0.06) and neither is KEV-listed; if you run PHP across shared-hosting stacks (cPanel, DirectAdmin) where upgrading lags, evaluate this extension as a temporary mitigation while scheduling the official PHP engine update.
SOC/IR — Plan: php2shell exploitation delivers web shells via the upload-progress path — with public PoCs now circulating, build or tune detections for anomalous PHP upload-progress requests and unexpected shell artifacts in web directories.
Leader — Skip
Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.05, public PoC on GitHub, reported by 4 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, public PoC on GitHub, reported by 4 collected sources

Virtual-Patch on CuraSec