Posted by jose on Oct 27 CVE-2026-109618: Pointer underflow in PHP's CGI SAPI enables unauthenticated remote code execution. Affected: ALL PHP versions 5.x through 8.4.26 with cgi.fix_pathinfo=1 (default configuration). Same vulnerability class as CVE-2019-11043 (PHP-FPM, CVSS 9.8, patched 2019) — the CGI SAPI never received the equivalent fix.
CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
About this summary. This is a short excerpt from the description that Full Disclosure published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/fulldisclosure/2026/Oct/38
Source attribution: headline and facts are from Full Disclosure (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and…
Introducing the Cloudflare PHP Capture the Flag challenge
Last week was one for the Internet security history books. First, eight eMudhra intermediate certificates were compromised, creating the possibility of forged…
Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities that can allow unauthenticated remote code execution. Both are fixed in PHP…
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its…
The adversary economy: How threat actors are reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure…
PHP2Shell Exploit Tooling Found on Exposed Attacker Server
SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an…