PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

If you run PHP versions 8.2 or 8.4, you can disable session.upload_progress in your php.ini to mitigate risk.

Two heap use-after-free vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been identified in PHP's session.upload_progress handler, specifically in the php_session_rfc1867_callback function. These vulnerabilities allow attackers to execute arbitrary code by manipulating cached bucket pointers within HashTables. The handler caches pointers to `post_bytes_processed` and `current_file_bytes_processed`, which are located in arrays that the request lifecycle frees prematurely. An attacker can trigger this by sending a single multipart POST request, followed by an update that re-reads the session file. This process causes the previously decoded session data to be freed, leaving stale pointers. When these stale pointers are later used in a call to `zend_call_function`, they can be leveraged to execute arbitrary commands, such as `system()`. The vulnerabilities have been confirmed in PHP versions 8.4.4, 8.2.34, and specific LiteSpeed lsphp82 builds.

The discovery of these vulnerabilities highlights a recurring theme in web application security: the complexity of session management and file upload handling can introduce subtle yet critical memory corruption bugs. Attackers can chain these bugs, weaponizing a heap use-after-free to achieve remote code execution, which is the most severe class of vulnerability. The fact that the exploit only requires a stock PHP configuration and a single multipart POST request makes it highly accessible to attackers.

The detailed analysis and provided framework for extracting build-specific deltas suggest a sophisticated understanding of PHP's internal memory structures and build processes. This level of detail indicates that similar vulnerabilities might exist in other PHP components or versions, and that attackers are investing significant effort in developing reliable exploit chains. Developers should prioritize upgrading to patched versions and implement edge-level security measures, such as WAF rules, to block malicious multipart POST requests until official patches are applied.