CRITICAL SECURITY ADVISORY - PHP Remote Code Execution

Severity: CRITICAL (CVSS 9.2)

CVEs: CVE-2026-109618 / CVE-2026-109619

Status: Emergency security updates pending



Dear Customers,

We are alerting all customers to two reported critical PHP vulnerabilities potentially allowing unauthenticated Remote Code Execution (RCE), which could result in complete server compromise. Official security patches are expected later today, October 21, 2026.



IMPORTANT - TEMPORARY MITIGATION

Preliminary reports suggest the vulnerabilities may involve PHP's handling of multipart HTTP requests, commonly used for file uploads. As an emergency precaution, customers may consider temporarily blocking these requests at the web server level.



Apache 2.4:

<If "req('Content-Type') =~ /multipart/i">

  Require all denied

</If>



NGINX:

if ($http_content_type ~* "multipart") {

  return 415;

}



WARNING - SERVICE IMPACT

Blocking multipart requests will disrupt legitimate file uploads, CMS media management, contact forms with attachments, and certain API integrations. These measures are precautionary and are not confirmed to provide complete protection against both vulnerabilities. Test all changes carefully.



CLOUDFLARE / WAF PROTECTION

Cloudflare and other WAF providers are reportedly implementing additional protections. Complete protection has not been confirmed. Customers should not rely solely on WAF filtering.



RECOMMENDED ACTIONS

- Review all PHP-based systems.

- Consider temporary multipart request restrictions.

- Monitor for suspicious activity.

- Prepare to apply official PHP security patches immediately.

- Prioritize unsupported PHP installations.



FURTHER UPDATES

Our NOC is actively monitoring the situation and will provide further guidance as confirmed information becomes available.



Please treat this advisory as a critical security priority.

NFOrce Network Operations Center