PHP CVE-2026-109618 and CVE-2026-109619: early mitigation steps

Later this afternoon, PHP is going to announce the patches for two highly critical vulnerabilities found in the PHP core. Both seem exploitable without authentication on any remote website that has sessions or file uploads enabled, which both are enabled in the default php.ini config.