On October 20th, 2026, the PHP Security Team issued an advanced notice and security advisory disclosing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated CVSS v4.0 9.2, affecting PHP installations.
To protect against potential exploits targeting these PHP vulnerabilities, two mitigation options are available:
Option 1: HAProxy Enterprise WAF Updated Rules – Inspects incoming HTTP requests to block attack vectors targeting these PHP security issues without requiring changes to backend application code.
Option 2: HAProxy Workaround Configuration – Uses HAProxy configuration syntax to block targeted attacks before traffic reaches PHP backends.
Issue details
The disclosed critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) impact various core PHP functions and runtime environments. Unauthenticated attackers could exploit these flaws to achieve remote code execution or cause severe system degradation depending on the application environment.
RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
Affected versions
The vulnerabilities affect all PHP installations serving web traffic across common runtime environments, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Patched releases, specifically PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, address these security issues. For more detailed release notes and download links, please refer to the official PHP announcement.
Recommended actions
Customers using the HAProxy Enterprise WAF simply need to update their rules.
Option 1: Update Intelligent WAF Engine rules
Update HAProxy Enterprise to the latest Intelligent WAF Engine rules to enable immediate inspection and blocking of exploit attempts. Update instructions are covered in the customer documentation
Option 2: HAProxy workaround configuration
If updating WAF rules immediately is not feasible, implement a workaround configuration to the HAProxy frontend to filter suspicious requests before they reach the PHP backend:
| frontend http-in | |
| # Enable waiting for whole HTTP request body | |
| option http-buffer-request | |
| # Detect session_upload_progress in body | |
| acl is_upload_progress req.body -m sub -i "PHP_SESSION_UPLOAD_PROGRESS" | |
| # Content-Type header-level block. | |
| acl php2s_mp req.fhdr(content-type) -m sub -i multipart/form-data | |
| # List of safe upload paths | |
| acl php2s_up_ok path_beg -f /etc/hapee-3.X/upload-paths.lst | |
| # Deny request if vulnerability acls trigger | |
| http-request deny deny_status 403 if is_upload_progress | |
| http-request deny deny_status 403 if php2s_mp !php2s_up_ok |
Note: The configuration covers the most common attack vectors, but HAProxy Enterprise WAF is the recommended solution. The workaround has two limitations:
Payload padding: Attackers can pad the request payload to evade the ACL checks, whereas the WAF accounts for this evasion.
Custom session settings: Administrators can change
session.upload_progress.name. If the setting is changed, update theis_upload_progressACL to match.
HAProxy Enterprise WAF users with updated rule sets, or those who have applied the workaround configuration, are protected against exploitation attempts.
We strongly recommend upgrading PHP installations to the fixed releases as soon as they are made available by the PHP security team. For further security notices and release updates, visit the PHP 2026 news archive.
Subscribe to our blog. Get the latest release updates, tutorials, and deep-dives from HAProxy experts.
