PHP Vulnerability Mitigation – CVE-2026-109618 & CVE-2026-109619
This article describes the configuration steps required on the Barracuda Web Application Firewall to mitigate two PHP vulnerabilities:
CVE-2026-109618 (abuse of multipart/form-data file uploads)
CVE-2026-109619 (malicious request parameter injection)
Apply the relevant mitigation for each vulnerability to every affected service; if a service is exposed to both vulnerabilities, apply both procedures.
CVE-2026-109618 – Mitigation Steps
As a short-term mitigation, limit the maximum content length accepted for multipart/form-data uploads to 32 KB (32768 bytes), unless the application requires larger file uploads. You can configure the content length at the Security Policy level or the URL Profile level.
Option A: Configure at the Security Policy level
Go to SECURITY POLICIES > URL Protection.
Select the relevant security policy.
Set Max Content Length to 32768 (32k).
Option B: Configure at the URL Profile level
Go to WEBSITES > Website Profiles.
Edit the relevant URL profile.
Set Max Content Length to 32768 (32k).
This is a stopgap measure. It may cause false positives only where large file uploads are legitimately required, but it is a better interim option than blocking multipart/form-data traffic entirely or taking the website offline. A future signature update will address additional evasion techniques, including chunk-encoded requests, excessive header counts within multipart bodies, and empty filename fields.
CVE-2026-109619 – Mitigation Steps
This mitigation blocks the malicious PHP_SESSION_UPLOAD_PROGRESS parameter pattern using a custom Attack Type and Parameter Class.
Step 1: Create a Custom Attack Type Group
Log in to the Barracuda Web Application Firewall web interface and go to ADVANCED > Libraries > Attack Types.
Create a new group named “PHP-AttackGroup-For-CVE-2026-109619”.
Step 2: Add a Pattern to the Group
Add a pattern named “Disallow-Any-Character” to the group.
Set Pattern Regex to (.)+ and Operating Mode to Active.
Once saved, the group lists the new pattern as Active:
Step 3: Create a Custom Parameter Class
Add a new Custom Parameter Class named “PHP-Vulnerabilities-Class-For-CVE-2026-109619”.
Under Custom Blocked Attack Types, select “PHP-AttackGroup-For-CVE-2026-109619”.
Step 4: Apply the Parameter Class to Parameter Profiles
Repeat the following for every URL profile in the service that carries PHP traffic:
If a URL profile exists - Create a Parameter Profile named “CVE-2026-109619” with parameter name PHP_SESSION_UPLOAD_PROGRESS, set Parameter Class to CUSTOM, and associate the Custom Parameter Class “PHP-Vulnerabilities-Class-For-CVE-2026-109619”.
If no URL profile exists - Create the URL profile with URL = /*, Host = *, Extended Match = (Header Content-Type contains multipart/form-data), Extended Match Sequence = 100 and Mode = Active, then add the Parameter Profile as described above.