Global

uploadprogress and the Zend engine's OOM bailout. 11. Pre-auth.

2 - Critical): On October 20, details of two pre-auth Remote Code Execution (RCE) flaws in the PHP core leaked online ahead of coordinated disclosure. Exploitation allows arbitrary command execution straight from the web server.

Use phpcheck-server when you have server access, or phpcheck-url when you only have a URL:

uploadprogress (modphp). Build profiles, labs, heap calibration and detection guidance for authorized security testing.

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. 5; Sury, cPanel EA4, DirectAdmin, Docker, Windows.