Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal

What it is

A VirusTotal Internet Scanning analysis of the PHP footprint exposed to CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. The PHP security team announced an out-of-band release for 21 October 2026, 14:00 UTC. Technical details leaked hours earlier and point to the session.upload_progress feature, present since PHP 5.4.0 and enabled by default. The post's counts describe the Internet-facing PHP footprint, not confirmed vulnerable hosts. Official affected and fixed versions come from the PHP project.

Preconditions / Affected

• About 5.1M IPs run PHP, and about 3.8M of them have an open port. Only about 1.1M announce a version, so roughly four in five hide it. A version-string search therefore sees only the minority that volunteers it.
• About 758K disclose an end-of-life branch (5.4 to 8.1). These have the feature on by default and get no security fixes. PHP 7.4 accounts for about 187K and PHP 5.4 for about 119K.
• About 272K run a supported branch (8.2 to 8.5).
• About 88K run PHP 5.2 or 5.3, which predate session.upload_progress.
• About 85K IPs run the 24 September 2026 releases (8.3.35, 8.2.34, 8.4.26, 8.5.11), so being current before this fix does not protect them.
• Co-exposure: about 394K PHP hosts have port 22 open, about 233K have 3306, and about 68K have 3389.
• WordPress is on about 538K IPs, Laravel on about 141K and Nextcloud on about 107K. Roundcube and phpMyAdmin add about 25K.

How the build-matching query works

The leaked material references LiteSpeed lsphp82 8.2.34 builds for Debian 12, Ubuntu 22.04 and Ubuntu 24.04. HTTP headers cannot tell these apart, but the OpenSSH package on port 22 can. The bracket syntax pins each condition to a port:

entity:ip port_service_cpe:php port_banner:"PHP/8.2.34" port_service_version[22]:"9.6p1 Ubuntu"

About 3.5K IPs show both LiteSpeed and PHP 8.2.34 in banners, and about 500 of those have port 22 open. Across all PHP 8.2.34 hosts, the OpenSSH package matches Ubuntu 24.04 on 269 IPs, Ubuntu 22.04 on 112 and Debian 12 on 65. Port 22 shows the host OS, so PHP in a container may sit on a different base image.

What to do

1. Patch to the fixed release of your branch (8.2, 8.3, 8.4 or 8.5) from php.net or your distribution.
2. If you run 5.4 to 8.1, upgrade the branch or check whether your vendor ships a backport.
3. Until patched, set session.upload_progress.enabled = Off in php.ini or the pool config, then reload PHP-FPM, Apache or LSAPI. This only breaks upload progress bars.
4. Where uploads are not needed, block or inspect multipart/form-data at the edge. Cloudflare shipped emergency Managed and Free ruleset rules on 21 October 2026.
5. Confirm origins are not directly reachable, or the WAF can be bypassed. Find exposed origins in your own ranges with entity:ip port_service_cpe:php asn:<your ASN>.
6. Do not rely on expose_php = Off. It hides the header, not the vulnerability.

To follow new reporting, use entity:collection collection_type:report "CVE-2026-109618". VirusTotal had ingested 21 crowdsourced reports by the time of writing.

Caveats

• Community analysis suggests the Off setting may not cover every vector, so it is a stopgap.
• Cloudflare's CTO Dane Knecht said its rules cover known payloads and that only updating PHP fully protects a site.
• Counts were taken on 21 October 2026. They are medians of seven runs, rounded, because large result sets return estimated totals.
• Port modifiers without a bracketed port match per IP, not per port.
• The post says nothing on the vulnerability class or on exploit conditions beyond the leaked pointer to session.upload_progress.