php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619

Reported by Elastic Security Labs (Ruben Groenewoud,Bryan Porras Blanch)

Summary by Cyber Security News21 Oct 2026, 02:00 CET

About this summary. This is a short excerpt from the description that Elastic Security Labs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.elastic.co/security-labs/threat-command/php2shell-php-rce-detection

On October 20, 2026, details of two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online ahead of their coordinated disclosure and before any patch existed. The PHP security team responded with advance notice of an emergency security release, scheduled for October 21, 2026 at 14:00 UTC, and rated both flaws critical with a CVSS v4.0 score of 9.2.

Read the full article at Elastic Security Labs →

Source attribution: headline and facts are from Elastic Security Labs (elastic.co). Summary method: excerpt of the source description. See our source attribution policy.