21 Oct 2026 Security advisory: Critical remote code execution vulnerabilities, update now

Jade @ Absolute Hosting

Jade @ Absolute Hosting

Absolute Hosting Representative
Company Rep
Company Rep
Joined
Nov 17, 2015
Messages
2,064
Reaction score
1,477
Location
Centurion
Mitigation whilst you patch :

disable session.upload_progress.enabled on all versions of php

www.php.net

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
www.php.net www.php.net
www.huntress.com

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress

Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.
www.huntress.com www.huntress.com

NVD - Home

nvd.nist.gov nvd.nist.gov

NVD - Home

nvd.nist.gov nvd.nist.gov

mybroadband.co.za

Thousands of Internet servers in South Africa at risk of being taken over

The leak of two critical PHP vulnerabilities has put millions of servers worldwide and thousands in South Africa in danger of remote execution attacks.
mybroadband.co.za mybroadband.co.za
 
If you cannot update yet, PHP's own interim measures are session.upload_progress.enabled=0 in php.ini or the FPM pool (then restart every worker), memory_limit=-1 set so applications cannot override it, and a low post_max_size (8M, or 32M if you need uploads). On PHP 8.5 also set fatal_error_backtraces=0
 
The last month or so has felt crazy with all the vulnerabilities being found recently with:
- Mikrotik
- SmarterMail
- PHP

I recently containerized everything I run on my servers and use kubernetes, which hopefully limits the amount of damage that can be done if something is hacked, as every application is isolated, and keeps things simple to upgrade as I just have to update the image to point to the latest version, although this PHP update is taking long to propgate on DockerHub, they have created tags for php:8.5.12-***** but still waiting on them to push the images. (have made the php.ini changes in the meantime)
 
Jason-ZA said:
The last month or so has felt crazy with all the vulnerabilities being found recently with:
- Mikrotik
- SmarterMail
- PHP

I recently containerized everything I run on my servers and use kubernetes, which hopefully limits the amount of damage that can be done if something is hacked, as every application is isolated, and keeps things simple to upgrade as I just have to update the image to point to the latest version, although this PHP update is taking long to propgate on DockerHub, they have created tags for php:8.5.12-***** but still waiting on them to push the images. (have made the php.ini changes in the meantime)
Click to expand...
I feel your pain Jason, it's been a game of ping pong all month as you mentioned.

Lets hope for the best over the Nov/Dec period so that we can all get some much deserved time off.
 
Last edited:
Hi Team! Just confirming - it doesn't look like we're able to set `session.upload_progress` via Absolute's High Performance WordPress hosting. Will this be applied server-wide so long?
 
Zertop said:
Hi Team! Just confirming - it doesn't look like we're able to set `session.upload_progress` via Absolute's High Performance WordPress hosting. Will this be applied server-wide so long?
Click to expand...
Hey hey Zertop

We are already applying mitigations and busy with patching so nothing for you to do right now.

Thanks for checking in
 
warrenpridgeon said:
I once bought myself a few months of pain trying to upgrade someone's semi self built CRM when their provider (RIGHTFULLY) axed the PHP version it was built on. lol. It's a necessary "evil" though.
Click to expand...
Yeah it’s not an easy decision but a necessary one, I have braced the team in anticipation for the pain
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X