CVE-2026-109618 and CVE-2026-109619: Bunny Shield's response to critical PHP vulnerabilities

Update - 21 October, 2026 14:15 UTC: PHP has published its security releases and technical advisories. We have updated this post with the fixed versions and added two managed WAF rules for multipart request patterns described in the advisory for CVE-2026-109618. Our earlier upload-progress rule targets one confirmed path for CVE-2026-109619. Matching requests are blocked only when your Shield Zone's WAF is in blocking mode; log-only mode does not block them.

The PHP security team has announced an emergency release to address two critical vulnerabilities, each rated 9.2 under CVSS v4.0. Researchers are tracking the reported issues as CVE-2026-109618 and CVE-2026-109619. PHP plans to publish its security release on October 21, 2026 at 14:00 UTC and has urged users to prepare to update promptly. Read PHP's security announcement and its advisories for CVE-2026-109618 and CVE-2026-109619.

Bunny Shield has expanded its managed WAF coverage with two additional multipart rules, alongside the upload-progress rule we activated ahead of the release. These rules target specific request patterns described in PHP's advisories while customers update their PHP installations. They block matching requests only when your Shield Zone's WAF is in blocking mode.

Understanding the vulnerabilities

CVE-2026-109618 - RCE via OOM corruption

PHP's out-of-memory handling can interrupt a request while internal data is only partly initialized. Cleanup can then use that invalid data. PHP has demonstrated unauthenticated code execution against mod_php before application code runs. Its advisory describes several ways multipart requests can drive memory exhaustion, including requests without a usable declared length and deeply nested field names.

CVE-2026-109619 - RCE via stale global state

Request-owned state can remain accessible after its memory is freed. A later request handled by the same worker may encounter that stale state before PHP resets it. PHP confirms a session upload-progress path, as well as other paths involving fatal errors and early initialization. Blocking the default upload-progress field addresses one request pattern; it does not cover every path to this vulnerability.

Fixed PHP versions

PHP branch	Fixed release
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

How Bunny Shield protects your site

Three managed WAF rules now address request patterns associated with the confirmed paths:

Managed rule	What it matches	Relevant path
WAF-PHP-UPLOAD-PROGRESS-POC	Multipart requests containing the default PHP_SESSION_UPLOAD_PROGRESS field	The confirmed session upload-progress path for CVE-2026-109619
WAF-PHP-MULTIPART-NESTING	Multipart field names nested 20 or more levels	The nested-input memory pressure described for CVE-2026-109618

What you should do now

• Identify every PHP origin and version serving your websites, including sites behind content management systems and custom applications.
• Prepare to install PHP's fixed releases when the official advisory is published. Confirm the effective runtime version after updating; a WAF is an additional layer, not a substitute for the software fix.
• Check whether your application uses session upload progress. If it does not, consider disabling session.upload_progress.enabled in the effective PHP configuration. PHP documents this setting; turning it off prevents that feature from recording progress, but does not disable multipart upload parsing or establish a fix for either CVE.
• Keep Bunny Shield enabled and review security events for blocked requests. If your application relies on PHP session upload progress, test that workflow and contact support if it is affected.

Protection while you update

Security releases can take time to reach every server, especially across large fleets and managed hosting environments. Bunny Shield is already blocking the public request pattern before it reaches an origin while teams complete their PHP update rollout. We will keep monitoring the official advisory and new exploit research, then refine our protections as verified details become available.

To get started with Bunny Shield, log in to your bunny.net account or sign up. Keep PHP updated even when your site is protected at the edge.When your Shield Zone's WAF is in blocking mode, Bunny Shield blocks matching requests before they reach your origin. In log-only mode, these rules do not block requests. We respect the mode configured for your zone.

These rules reduce exposure to the request patterns they match; they are not complete mitigations for either CVE. Other routes to memory exhaustion or stale state are possible, and a customized upload-progress field name will not match the default-field rule. Applications using PHP session upload progress or unusually deep form fields may have legitimate requests matched by these rules. Review affected workflows and your Shield security events.

What you should do now

• Patch PHP immediately to the fixed release for your branch, or install your distribution's verified backport. Check every PHP origin and restart workers as required by your deployment.
• Check your Bunny Shield WAF mode. Use blocking mode if you want these managed rules to stop matching requests. Log-only mode will not block them.
• Review upload workflows and security events, particularly if your application uses session upload progress or deeply nested fields.
• Follow PHP's temporary guidance if you cannot update at once. Its advisory covers administrative memory and request-size limits, and disabling session.upload_progress.enabled with a worker restart for the confirmed session path. These measures reduce exposure to particular paths; PHP says updating is the only complete solution.

Protection while you update

Bunny Shield can block the two identified request patterns at the edge for customers using WAF blocking mode. We'll continue reviewing PHP's advisories and emerging attack techniques and refine our managed rules as needed. Install the PHP security release even if Bunny Shield is blocking traffic: the vulnerabilities have paths outside these WAF matches.

To get started with Bunny Shield, log in to your bunny.net account or sign up.