Updating to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 fixes the engine's out-of-memory corruption and stale worker state, and CISA placed both CVEs on the KEV catalog with an October 29 federal deadline. What stood out to me in the post-patch testing from Abstract Security is that patched hosts still leave session.upload_progress.enabled = 1 on by default, turning any postponed local file inclusion (LFI) bug into an unauthenticated two-request RCE.

1. Pre-Script Execution via longjmp() Cleanup

In unpatched versions (5.4 through 8.5), CVE-2026-109618 triggers when an out-of-memory error forces a longjmp() bailout while internal request structures are only partially initialized. During request shutdown, PHP's cleanup routine trusts those uninitialized pointers before a single line of application code runs, while CVE-2026-109619 leaves freed request pointers alive in global state for the next request on the same PHP-FPM or mod_php worker.

2. Why ini_set() and Upload Progress Tweaks Fail

Setting session.upload_progress.enabled=0 inside application code does nothing against the engine CVEs because memory exhaustion occurs during initial request parsing. Even on freshly patched 8.2.35 servers, an attacker can pass a chosen session ID via a multipart form field to write an unsanitized filename directly into the session file on disk; if your codebase has a dormant include($_GET['page']) style LFI, racing a concurrent read against that active upload executes arbitrary code even with session.use_strict_mode = 1.

3. Lock Down the Parser Boundary and Verify Builds

Check your active runtime build date and patch level first, then disable upload progress in php.ini so session files cannot be used as an unauthenticated staging ground:

; php.ini - must be set at the INI or pool level, not runtime session.upload_progress.enabled = 0 max_input_vars = 1000 post_max_size = 8M

For teams triaging exposure across legacy 7.4–8.1 backports and newer runtimes, we map emergency advisories to response workflows in our xSypher product security runbooks alongside our verification standards.

Are you backporting the minimal source patches for EOL PHP 7.4/8.1 runtimes in production, or isolating legacy workers behind strict reverse-proxy body limits until you can upgrade?