PHP CVE-2026-109618 CVE-2026-109619

Hi Chammi Kumara & thx for join me at Q&A platform,

two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are definitely worth taking seriously. The PHP security team has confirmed two critical issues, both rated 9.2 under CVSS v4.0, with an emergency security release scheduled for October 21 at 14:00 UTC. Researchers have described them as potential remote code execution vulnerabilities, although the official technical details and affected versions haven't been fully disclosed yet.

Regarding Azure WAF, I haven't found an official Microsoft announcement confirming dedicated signatures for either CVE or a release date for them. Azure Application Gateway WAF and Azure Front Door WAF use different managed rule sets, so any coverage needs to be confirmed for the specific service and rule-set version ur using.

Existing managed rules might detect some malicious request patterns, but that doesn't guarantee protection against these particular vulnerabilities. Cloudflare has already announced emergency WAF mitigations for known exploit patterns, but those rules shouldn't be confused with Azure WAF protection.

For now, I'd prioritize identifying internet-facing PHP applications and preparing to deploy the official PHP security updates as soon as they're available. Keep the latest Azure WAF managed rules enabled, review WAF and application logs for suspicious requests, and consider restricting unnecessary upload functionality where ur application doesn't require it. I wouldn't recommend blindly blocking all multipart requests without checking the impact on legitimate traffic.

I'd also raise a case with the Azure WAF product team asking whether CVE-specific detection is being developed for Application Gateway WAF or Front Door WAF, and whether any existing managed rule IDs provide verified coverage.

The key point is that WAF mitigation is an additional layer, not a replacement for patching PHP. Until Microsoft confirms specific coverage, I wouldn't assume Azure WAF is protecting against either CVE.

rgds,

Alex

p.s. if my answer is help - pls mark it as an answer

This website provide great intel on the Microsoft action plan.

https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html