Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)

Reported by Kaspersky Securelist (Kaspersky)

Summary by Cyber Security News21 Oct 2026, 17:18 CET

About this summary. This is a short excerpt from the description that Kaspersky Securelist published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/

Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on the CVSS scale). The patches were released on Wednesday, October 21, 2026, at 14:00 UTC. The release was expedited after information about the vulnerabilities was leaked to the public before the scheduled embargo was lifted.

Read the full article at Kaspersky Securelist →

Source attribution: headline and facts are from Kaspersky Securelist (securelist.com). Summary method: excerpt of the source description. See our source attribution policy.