Mitigation whilst you patch :
disable session.upload_progress.enabled on all versions of php
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
https://nvd.nist.gov/vuln/detail/cve-2026-109618...
Dear Customer,
We would like to inform you that critical security vulnerabilities affecting WHMCS have been identified. Hotfixes are now available. All vulnerabilities addressed in this release were identified internally through our security review process. We are not aware of any...