CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks

Reported by Zscaler ThreatLabz (Jithin Prajeev Nair (Director, Threat Research))

Summary by Cyber Security News22 Oct 2026, 00:21 CET

About this summary. This is a short excerpt from the description that Zscaler ThreatLabz published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce

IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10. The PHP security team has released emergency patches and strongly encouraged all PHP users to update immediately.

Read the full article at Zscaler ThreatLabz →

Source attribution: headline and facts are from Zscaler ThreatLabz (zscaler.com). Summary method: excerpt of the source description. See our source attribution policy.