PHP RCE Mitigation Auditor CVE-2026-109618 / 19

Add inside your site configuration (or in a shared snippet included by all sites):

# Block multipart before PHP execution
if ($http_content_type ~* ".*multipart.*") {
    return 415; # Unsupported Media Type
}

# Neutralize upload progress inside FastCGI
location ~ \.php$ {
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
    fastcgi_param PHP_ADMIN_VALUE "session.upload_progress.enabled=0\nmemory_limit=-1\npost_max_size=16M";
}

Reload: sudo nginx -t && sudo systemctl reload nginx

Add inside your VirtualHost or root .htaccess:

# 1. Block multipart before PHP execution
<If "req('Content-Type') =~ /multipart/i">
    Require all denied
</If>

# 2, 3, 4. Runtime interim options (mod_php or .htaccess)
php_admin_value session.upload_progress.enabled 0
php_admin_value memory_limit -1
php_admin_value post_max_size 16M

Reload: sudo apache2ctl configtest && sudo systemctl reload apache2

Disable upload progress in PHP configuration:

; In /etc/php/8.2/fpm/conf.d/99-mitigation.ini (or php.ini)
; 1. Block multipart handled at Nginx/Apache level
; 2. Disable upload progress
session.upload_progress.enabled = 0

; 3. Prevent OOM bailout state corruption (Interim)
memory_limit = -1

; 4. Strictly cap payload size to 16M
post_max_size = 16M
upload_max_filesize = 16M
expose_php = Off

Reload: sudo systemctl restart php8.2-fpm

In Cloudflare Dashboard → Security → WAF → Custom Rules:

Rule: (http.request.headers["content-type"][0] contains "multipart")
Action: Block (Status 403 or 415)

Applies globally across edge points immediately.

1. Check installed PHP packages:

dpkg -l 'php*' | awk '/^ii/{print $2, $3}'

2. Update package lists & verify update is waiting:

sudo apt-get update
apt list --upgradable 2>/dev/null | grep php

3. Upgrade only the PHP packages (safe, won't break system):

sudo apt-get install --only-upgrade 'php8.2*'

4. Restart PHP-FPM & verify changelog:

sudo systemctl restart php8.2-fpm
zgrep -E 'CVE-2026-10961[89]' /usr/share/doc/php8.2-fpm/changelog.Debian.gz

RHEL / Rocky / AlmaLinux (Remi Repository):

sudo dnf clean metadata
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

Docker Containers:

docker pull php:8.2.35-fpm
docker compose build --pull && docker compose up -d

Phase 3: Rollback the Interim 415 Block:

# Remove 'if ($http_content_type ~* ".*multipart.*") { return 415; }' from Nginx
sudo nginx -t && sudo systemctl reload nginx

✔ File uploads and multipart forms will now work normally with full zero-day immunity!