PHP Pre-Announces Two CVSS 9.2 Flaws for 14:00 UTC and Names No Versions

The PHP security team announced on Oct. 20 that it will ship a release at 14:00 UTC on Wednesday, Oct. 21, fixing two vulnerabilities that each carry a CVSS v4.0 score of 9.2 (Critical). The notice names no affected version, no component and no CVE identifier, so nobody outside the team can yet say which installations are exposed.

The announcement was posted to the php.announce list at 19:33 UTC on Oct. 20 by Jakub Zelenka and signed "The PHP security team." It adds: "We reserve the right to release earlier if details of either vulnerability become public." The same text appears in the php.net 2026 archive, which says affected and fixed versions will be published with the release.

What php.net has and has not said

A 9.2 under CVSS v4.0 describes the vector, not the install base. The notice gives no attack vector, no privilege requirement and no word on whether either flaw is reachable with default settings. Until the advisory lands, the score can be neither deflated nor defended, because its inputs are missing.

Item	php.net, Oct. 20 notice
Number of flaws	2
Score	CVSS v4.0 9.2 each
Release time	Oct. 21, 14:00 UTC
Affected versions	Not named
CVE IDs	Not named

The last previous security release was Sept. 24, when PHP shipped 8.5.11, 8.4.26, 8.3.35 and 8.2.34. The php-src advisories page lists six advisories dated that day, one rated High (an unbounded recursion in the SOAP extension) and the rest Moderate or Low. It shows nothing from October.

The third-party post that does name versions

On the day of the notice, a self-published post at jackalsyn.com, attributed to "J4ck3LSyN (ATLAS)", described two heap use-after-free bugs, CVE-2026-109618 and CVE-2026-109619, in PHP's session.upload_progress handler. It says a single multipart POST is enough on a stock configuration, where session.upload_progress.enabled defaults to 1, and it promotes an exploit download.

Nothing ties that post to PHP's notice. The notice cites no component and no CVE, and the post itself states that its root-cause analysis is unconfirmed. The two identifiers are not in the PHP pages fetched for this report.

The post also contradicts php.net on a checkable point. It lists 8.5.11, 8.4.26, 8.3.35 and 8.2.34 as the fixed releases. Those are the September 24 builds, and php.net says the fix for the two critical flaws ships on Oct. 21. Either the post's author is wrong about which builds are fixed, or its bugs are not the ones PHP is patching.

What operators can do before 14:00 UTC

The post's own mitigation is to set session.upload_progress.enabled = Off in php.ini, .user.ini or .htaccess and reload PHP-FPM or the web server. Whether that closes either official flaw is unknown. The post itself says the multipart parser path is independent of the session setting, and suggests tighter inspection of multipart POSTs at the proxy.

The practical instruction is to inventory every PHP host with php -v and have the update path for each supported branch ready. The post says PHP 7.x and older will get no fix.

PHP says it may release early if details leak or exploitation is seen, and neither condition is confirmed in the notice. The next verifiable fact is the release itself, due at 14:00 UTC today. For two other patch-window stories this week, see the Tor exit relay SSH interception report and the eMudhra CA key compromise.