Mitigation whilst you patch :
disable session.upload_progress.enabled on all versions of php
https://www.php.net/archive/2026.php#2026-10-21-5
https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
https://nvd.nist.gov/vuln/detail/cve-2026-109618...