PHP 8.2.35 security update: should you disable session upload progress?
PHP 8.2.35 security update explained: patched PHP versions, PHP2Shell risks, Apache mod_php concerns, and when to disable session upload progress.
Website administrators have another reason to review their PHP security settings after the PHP development team released emergency fixes for two critical vulnerabilities and published additional guidance on October 23. The PHP2Shell flaws can allow remote code execution without authentication, potentially giving attackers control over vulnerable server processes.
The original fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. However, the latest advisory introduces a separate concern involving session upload progress under an unusual configuration. Administrators need to distinguish this new warning from the two vulnerabilities already patched.
Which PHP versions have been fixed?
The PHP development team released security updates on October 21 for two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Each received a critical severity rating of 9.2 under CVSS version 4.0.
The fixed versions are:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
Administrators should install the appropriate update for their branch or use a security package supplied by their operating system or hosting provider. The official PHP advisory identifies installations serving web requests as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Older PHP branches require particular attention. PHP 8.1 and earlier are no longer supported by the main PHP project with regular binary releases, although certain distributions and long-term support vendors may provide backported security fixes. Organizations should verify their vendor’s guidance rather than assume that an older installation has been protected.
What makes the PHP2Shell flaws dangerous?
The two vulnerabilities involve errors in PHP’s internal memory handling.
CVE-2026-109618 concerns out-of-memory handling. When a request encounters a memory failure at a particular point during processing, PHP may leave internal data only partially initialized. Subsequent cleanup can then handle that invalid state incorrectly, creating an opportunity for memory corruption.
CVE-2026-109619 involves stale internal state. Information associated with an earlier request can remain available after its underlying memory has been freed. A later request handled by the same worker may encounter that stale state before PHP resets it.
Under the right conditions, these problems can allow remote code execution. An attacker may therefore be able to run code through a vulnerable PHP process without first logging in.
The PHP project considers Apache’s mod_php configuration particularly high risk because a demonstrated exploit can trigger the attack before application code runs. The practical risk can vary depending on the server setup, but administrators should not assume that a website is safe simply because its application has authentication.
New PHP security warning published on October 23
The PHP project’s October 23 informational advisory addresses a separate issue tracked as CVE-2026-115560. It involves session upload progress and applies only to an unusual combination of PHP settings and application behavior.
PHP recommends setting:
session.upload_progress.enabled=0
until the next regular bug-fix release to protect against this specific risk.
An application must use php_binary or php_serialize as its session serialization handler, switch to php at runtime through ini_set() before calling session_start(), and still have session upload progress enabled.
Applications that do not change their serialization handler at runtime do not need to disable the feature under this particular advisory.
Administrators should also note that PHP had already recommended disabling session upload progress as an interim mitigation for CVE-2026-109619. The October 23 notice adds a narrower, configuration-specific reason to keep that setting disabled until the next PHP release.
This warning should not be confused with the two PHP2Shell vulnerabilities. It concerns a separate issue that the PHP team says will receive a full advisory with a future release. Administrators should follow the official instructions and assess whether their applications use the affected configuration.
Exploitation attempts increased after disclosure
The vulnerabilities have also created an immediate challenge for organizations operating public-facing websites.
Cloudflare CEO Matthew Prince reported that the company’s network recorded thousands of exploitation attempts in the ten hours before public disclosure. The volume then increased to tens of thousands in the following 45 minutes, hundreds of thousands within two hours, and millions afterward.
Reuters reported that organizations in Japan, France, Finland and other countries took precautionary measures, including temporarily suspending some online services while applying security updates. Finland’s state IT services provider said restoring services could take days or weeks because systems need to be tested after patches are installed.
These reports show the operational consequences of a widely used software component developing a critical security issue. A precautionary shutdown does not, by itself, mean that a service was successfully breached.
The distinction matters: evidence of widespread exploitation attempts is not proof that every vulnerable server has been compromised.
Nevertheless, the availability of public technical details and proof-of-concept code increases the urgency of checking exposed systems.
What website administrators should do now
Administrators should first identify every PHP installation they manage, including versions bundled with hosting control panels, containers, commercial applications and other software. Checking only the main website may leave an older or separately packaged PHP runtime overlooked.
Next, install the correct security update and verify that the running service actually uses the patched version. Applications deployed through containers may need a rebuilt image and redeployment rather than a simple package update.
Systems that cannot be patched immediately should receive additional protection. CERT-EU advises organizations to consider isolating internet-facing applications from public networks until the fix has been applied and verified. A web application firewall or network restriction may reduce exposure, but it should not be treated as a replacement for the update.
Administrators should also review the October 23 session upload-progress advisory and disable the feature temporarily where the PHP team’s guidance applies. Monitoring PHP processes, investigating unusual child processes and reviewing server logs can help identify suspicious activity.
If there are signs of a compromise, teams should isolate the affected system, preserve relevant logs and investigate unexpected files, scheduled tasks, accounts and processes before restoring normal service.
The next step for PHP users
The immediate priority is to move affected installations to a fixed release and confirm that the update is active. Organizations running end-of-life PHP versions should also determine whether their vendor has issued a backported patch or whether a supported-version upgrade is required.
The October 23 notice adds a narrower configuration-specific issue to an already urgent security response. Keeping both advisories in view will help administrators address the known PHP2Shell vulnerabilities without overlooking the separate session upload-progress warning.
