CVE record · 38 sources
CVE-2026-109618
KEV · due 29 Oct 2026 (overdue)CVSS 9.8PHP Memory Corruption Vulnerability
- Vendor
- PHP
- Product
- PHP
- CVSS v3.0
- 9.8
- EPSS
- 1.00 (p100)
- CISA KEV
- added 26 Oct 2026, due 29 Oct 2026 (3d overdue)
- Weakness
- CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419
- Exposure class
- Edge / VPN / firewall, Web platform, Network management, Cloud platform
Coverage
55Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
-
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
*October 26, 2026: This advisory has been updated to clarify language describing exploitability and potential impact.*October 23, 2026: This advisory has been updated with new ThreatLabz analysis and Zscaler Deception telemetry…
-
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free…
-
php2shell one week later: Why one exploit doesn’t work everywhere
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the…
-
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure. Change log Update October 28…
-
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits…
-
PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory…
-
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 – PHP Memory Corruption…
-
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now.
-
CISA confirms PHP2Shell under attack as researchers clock successful exploits
Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells
-
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control…
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg
-
Memory corruption vulnerabilities in PHP
Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these…
-
Censys takes census of the Internet like no one else
Key Takeaways: A messy week for PHP: how PHP2Shell was disclosed On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both…
-
The adversary economy: How threat actors are reacting to PHP2Shell
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Key…
-
Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now
Executive Summary PHP2Shell refers to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each with a CVSS v4.0 score of 9.2, that can allow unauthenticated remote code execution on PHP installations serving web…
-
GCP-2026-074
Published: 2026-10-28 Description Description Severity Notes A Deserialization of Untrusted Data vulnerability was discovered in the SubWorkflow task in Application Integration versions prior to September 11, 2026. What should I…
-
PHP2Shell and eMudhra Patched
PHP2Shell and the eMudhra certificate compromise landed in the same week. Docker published a fixed PHP image within 24 hours and rebuilt the trust store across the catalog.
-
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)
Categories: Threat Research Tags: advisory, vulnerability, php
-
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For…
-
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) allow an…
-
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For…
-
PHP vulnerabilities
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.…
-
Security Update on PHP2Shell: Impact for Docker Customers
On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, commonly known as PHP2Shell.
-
Two critical RCEs in PHP core
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including…
-
Critical Vulnerabilities in PHP Require Immediate Patching
Update October 23, 2026 : CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.…
-
PHP2Shell Remote Code Execution Vulnerabilities
What is the Vulnerability? The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP's internal request-processing and memory-management…
-
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes…
-
Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
Executive Summary PHP2Shell’s fix is to update PHP, but patching at scale is slow. Only 199,000 of 156 million PHP installations were patched in the first 12 hours after disclosure. In the meantime, Qualys’s configuration-level…
-
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly…
-
Critical security issue affecting PHP
Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
-
PHP2Shell: What to know about two critical PHP flaws
Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes
-
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
We discuss the incident involving the leak of information about vulnerabilities CVE-2026-109618 and CVE-2026-109619. Kaspersky solutions detect the PHP2Shell exploit: we’ll walk you through examples using KEDR, KATA, and KES.
-
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to…
-
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
Learn about the two critical vulnerabilities in PHP dubbed PHP2Shell.
-
Introducing the Cloudflare PHP Capture the Flag challenge
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer.
-
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell…
-
PHP2Shell: No login, no app code, no warning. What next?
PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium
-
There's a third PHP2Shell bug, but it won't get an emergency fix
Bad things (and software bugs?) come in threes
-
CVE-2026-109618 / CVE-2026-109619
Advisory for PHP2Shell (CVE-2026-109618 and CVE-2026-109619): affected PHP versions, fixed releases, mitigations, monitoring guidance, and the NodeZero Rapid Response check.
-
PHP2Shell exploit bypasses protections designed to stop remote code execution
“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.
-
PHP2Shell Exposure Depends on More Than Whether You Use PHP
PHP2Shell exposure can extend into bundled runtimes, containers, and hosted applications. Learn why identifying affected PHP is only the first step toward validating exploitability.
-
PHP2Shell puts dozens of UK government services out of service
Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise
-
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed
-
PHP2Shell: Why many websites had to go offline
Many sites were taken offline so admins could patch two critical PHP flaws that could have let attackers run malicious code on their servers.
-
Cloudflare deploys protections against php2shell vulnerability
Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed…
-
PHP releases emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw. The post PHP releases emergency fixes for 2 critical vulnerabilities appeared first on…
-
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Two critical PHP RCEs, CVE-2026-109618 and CVE-2026-109619, leaked before the patch. Learn what's known, who's exposed, and how to prepare now.
-
26th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a…
-
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619…
-
PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
Websites down as precaution as exploits have already been published
-
Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
Snoops 'likely still' have access to US government-affiliated network