Barely 48 hours after issuing emergency software updates to neutralise two severe vulnerabilities, the PHP development team has uncovered another potential security risk in the widely used programming language that underpins countless websites across the globe.
On 23 October, an informational advisory warned server administrators of a rare security weakness involving file upload monitoring, catching website teams in the middle of patching the earlier flaws.
The revelation of a fresh threat so soon after the initial patching effort underscores the need for vigilance across web hosting environments.
A fresh risk in file upload monitoring
Published on PHP’s official website under the title “Informational advisory: Session upload progress,” this newly identified threat carries the designation CVE-2026-115560.
For non-technical readers, the weakness represents a rare remote code execution threat, a dangerous category of flaw that could theoretically allow an unauthorised attacker to run foreign commands on a server from afar.
While developers have not yet issued a dedicated software release for this fresh discovery, they have advised server administrators to adopt an immediate temporary defence until the next regular maintenance release arrives.
Crucially, the development team warned that this new recommendation is not an alternative or substitute for repairing the two earlier vulnerabilities, as each incident demands completely separate defensive measures.
To understand this latest threat in plain terms, the issue resides in a specialised PHP feature designed to help web applications monitor the progress of file uploads, much like an interactive visual bar showing a visitor how much of a document has reached a server.
According to the development team, exploiting this flaw requires an unusual combination of code and configuration that rarely occurs by accident.
Unpacking the dual memory flaws
This fresh alert comes on the heels of intense remediation efforts surrounding the two critical flaws disclosed on 21 October, tracked as CVE-2026-109618 and CVE-2026-109619.
Both of these earlier flaws also carry the threat of unauthorised remote code execution under specific circumstances, stemming from deep-seated memory management errors within the server engine.
The first vulnerability, CVE-2026-109618, arises when internal request-handling data suffers a memory issue before becoming fully prepared; when the server attempts to abort the request, that incomplete data is mishandled, opening a dangerous security gap.
The second vulnerability, CVE-2026-109619, occurs when internal details from an earlier web request linger in memory even after that memory block has been freed, enabling outdated information to be mistakenly reused during a subsequent request.
Security specialists and the PHP team have emphasised that the discovery of these flaws does not mean every PHP-powered website has already suffered an attack.
Even so, remote code execution flaws remain inherently serious because a successful attack allows an intruder to execute commands and manipulate server operations without permission.
Urgent patches and server-side exposure
To neutralise these two earlier memory flaws, the development team published four updated versions on 21 October – PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35.
Both CVE-2026-109618 and CVE-2026-109619 are remedied in these official updates, prompting developers to urge swift installation.
PHP explicitly cautioned that no alternative configuration tweaks can provide a complete solution, meaning server administrators cannot simply alter server settings to claim immunity; installing the patched versions is mandatory.
