Security researchers at Bi.Zone WAF have identified active attempts to exploit two critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619. These flaws allow unauthorized remote code execution on web servers. The vulnerabilities are linked to a use-after-free error within the session.upload_progress file upload mechanism, carrying a CVSS 4.0 score of 9.2 out of 10.
The affected PHP versions range from 5.4 through 8.5.4. Technical details for creating exploits have been published online, potentially lowering the barrier for attackers. Bi.Zone estimates that approximately 50,000 web applications across the Russian internet segment are currently exposed to these risks.
Bi.Zone WAF has implemented a filtering rule to detect common attack patterns, though the company notes this does not guarantee full protection against all variations. Organizations are advised to audit their PHP versions and apply patches as soon as they become available. For unsupported versions, experts recommend restricting public internet access to the applications.
