PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. This diary will be continuously updated today.
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
About this summary. This is a short excerpt from the description that SANS Internet Storm Center published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://isc.sans.edu/diary/rss/33440
Source attribution: headline and facts are from SANS Internet Storm Center (isc.sans.edu). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
PHP2Shell Exploit Tooling Found on Exposed Attacker Server
SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an…
Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities
Update, 10/21/2026, 9:55 a.m.: The patches have been released, with fixes shipped as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering the supported branches, 8.2…
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…
Introducing the Cloudflare PHP Capture the Flag challenge
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged…
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S.
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its…