22 October 2026
At 13:00 UTC on 21 October, Vigilance was keeping uploads out of PHP's reach on our production server. PHP's patch was due at 14:00. That morning is why we're opening Vigilance early.
CVE-2026-109618 and CVE-2026-109619 are in PHP's own handling of uploaded form data, which runs before any application code does. A WordPress site, a Laravel app and a hand-written script are equally exposed until PHP itself is updated. PHP rated both flaws critical and released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October. Amazon had recorded an attempt to exploit it four days earlier.
There are no complete mitigations, updating is the only safe choice.
PHP's release notes, 21 October
Many Ubuntu servers running a current PHP get it from Ondřej Surý's package archive. On 21 October the build for Ubuntu 22.04 appeared there at 15:46 UTC, and the build for 24.04 still hadn't been published at 16:40. Ubuntu's automatic updates also skip that archive unless someone has added it, so plenty of servers will run the old PHP until a person goes and updates it.
The flaw is reached before the application runs, so the only place to act is in front of PHP. That is where Vigilance sits: on the server, between nginx and php-fpm, reading every request before PHP does.
That morning we gave it a new setting. Forms sent in the upload format reached PHP as plain forms, and file uploads were refused everywhere except the few addresses that genuinely take files, which we listed from the applications on the server. It was on at 13:00 UTC. In the hours that followed it refused five uploads, all of them our own tests, and we switched it off at 16:55 once the server was running PHP 8.3.36.
It narrowed the way in for the hours before the patch landed. It doesn't replace the patch, and it only covers PHP that sits behind Vigilance.
Edge firewalls shipped rules for the known attack paths the same day, and Cloudflare made its rules available to every customer, free plans included. An edge firewall only sees the traffic that passes through it, though. A request sent straight to your server's own address goes around it. Vigilance is on the server, so every request through nginx reaches it first.
Every Vigilance install on our default updates takes an urgent signed release within about fifteen minutes, and as of this week a new rule can reach those installs, signed, without a restart. We're building the next step now: sending a measure like that morning's to every install the same way, the day a hole is published.
Early access is free for the first 25 servers running nginx with php-fpm.
Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's backport for older versions. Then check that your automatic updates include the archive your PHP comes from. PHP's advisory has the details.