Patchbay has not tested these steps. They come from the sources at the end of this page, mostly from Mattias Geniar's post. Read his post for the full configuration for each web server.

What happened

PHP will release fixes for two critical bugs on 21 October 2026 at 14:00 UTC. Both have a CVSS 4.0 score of 9.2.
CERT-EU says the bugs can let an attacker run code on the server, and could affect every PHP version from PHP 5 on.
PHP has not published any details yet. It says the affected versions and the fixed versions will come with the release.
Fixes come only for supported versions (8.2 and newer). PHP 8.1 and older will get no official fix.
Public write-ups, not confirmed by PHP, trace the bugs to a use-after-free in PHP's session upload-progress code. This code runs while PHP reads a multipart request, before your app's own code starts. So sign-in checks and middleware in your app (WordPress, Laravel, Magento and others) do not stop it.
Mattias Geniar quotes Cloudflare's CTO at 07:43 UTC on 21 October: "We are seeing early attacks emerging". PHP has not confirmed attacks.

Do this now

Patch. When PHP releases at 14:00 UTC, upgrade PHP. This is the only confirmed fix (PHP core developer Gina Banyard; Cloudflare). Then restart PHP-FPM, Apache, Octane and queue workers. Static builds, such as FrankenPHP, need a new release of that build.
On PHP 8.1 or older, plan the move to a supported version now. No fix will come for your version.
Until you can patch, turn off upload progress (interim, not proven):
- Setting: session.upload_progress.enabled = 0, then reload PHP.
- With PHP-FPM, lock it in each pool so no app can turn it back on: php_admin_flag[session.upload_progress.enabled] = off
- A PHP-FPM reload can give a short burst of 502 errors unless process_control_timeout is set.
- Check: php-fpm8.4 -i | grep session.upload_progress.enabled shows session.upload_progress.enabled => Off => Off (use your own version number).
If your site takes no file uploads, block multipart requests at the web server (interim, not proven). Geniar's post gives the rules for nginx, Apache, Caddy, lighttpd and FrankenPHP.
- Check: curl -s -o /dev/null -w '%{http_code}\n' -F a=b https://your-site/ prints 403.
If you can do none of these, CERT-EU says: think about taking internet-facing PHP apps off the public network until the fix is out.

What probably does not help

From Geniar's post: file_uploads = Off, a small post_max_size, enable_post_data_reading = Off, checks inside your own app, and a WAF when attackers can reach your server directly.

What is proven and what is not

Proven by Geniar (not by Patchbay):

With upload progress on, a request with no sign-in makes a new session file. With the setting off, it does not. Tested on PHP 8.4.17 and 8.4.26.
The web server rules return 403 for multipart requests on nginx 1.29.8, Apache 2.4.69, lighttpd 1.4.85, Caddy 2.10.2 and FrankenPHP 1.13.1.

Not proven:

That turning off upload progress stops the real attack. Geniar could not test it against the real exploit.
That the bug is in the upload progress code. PHP has not said where it is.
That no other multipart path is open.
That the proof-of-concept shared in public works.

Share a fix

Post with the tag php-cve-2026-109618. Name the site of the software you fixed, or php.net. A useful post says:

your PHP version and how PHP runs (FPM, mod_php, FrankenPHP, CGI);
your web server and its version;
what you changed;
the check you ran, and what it printed.

Never post a "fix" that turns off a security check, and never link to a patched PHP build from an unknown source.

Sources

Mattias Geniar, "PHP CVE-2026-109618 and CVE-2026-109619: early mitigation steps", 21 October 2026: https://ma.ttias.be/php-cve-2026-109618-early-mitigation/
PHP announcement, 20 October 2026: https://www.php.net/archive/2026.php#2026-10-20-1
CERT-EU security advisory 2026-018: https://cert.europa.eu/publications/security-advisories/2026-018/
Sansec: https://sansec.io/research/php2shell
Huntress: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
watchTowr FAQ: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
PHP supported versions: https://www.php.net/supported-versions.php

Pages 6

Actions 2

PHP: two critical bugs, CVE-2026-109618 and CVE-2026-109619