PHP session.upload_progress heap UAF (CVE-2026-109618 / -109619)

A heap use-after-free vulnerability (CVE-2026-109618/-109619) exists in PHP's session.upload_progress handler that allows attackers to execute arbitrary code like system() on vulnerable systems running PHP 8.2 and 8.4 with default configuration. The exploit works by manipulating cached bucket pointers during file uploads that are freed and reclaimed with attacker-controlled data, enabling code execution through zend_call_function. A proof-of-concept exploit framework has been released along with mitigation guidance recommending immediate inventory and patching of affected PHP installations.