DigiNews

Summary

Security researchers reveal a heap use-after-free in PHP session.upload_progress (CVE-2026-109618/109619) that can enable remote code execution via crafted multipart requests. The writeup detailing the internal PHP structures involved and PoC chains demonstrates how freed buckets can lead to a system() call, and it provides pre-patch mitigations and patched versions. It also credits researchers and provides download links for the exploit package.