CVE-2026-115560

Vendor

PHP, Cloudflare

Product

PHP, Cloudflare WARP / Workers / Zero Trust

CVSS v4.0

9.2

EPSS

1.00 (p100)

Exposure class

Web platform, Network management, Cloud platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 79
   Research Rapid7 10d ago

   CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

   Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free…

   Exploited CVSS 9.2 EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560 PHP
2. 68
   Tenable research Tenable 11d ago

   php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

   Two critical PHP vulnerabilities could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure. Change log Update October 28…

   Exploited CVSS 9.2 EPSS 0.16 No fix yet CVE-2026-109618CVE-2026-109619CVE-2026-46300+5 more PHP
3. 52
   Qualys TRU Qualys 11d ago

   Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now

   Executive Summary PHP2Shell refers to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each with a CVSS v4.0 score of 9.2, that can allow unauthenticated remote code execution on PHP installations serving web…

   CVSS 9.2 EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560 Cloudflare PHP
4. 41
   Threat signal FortiGuard 9d ago

   PHP2Shell Remote Code Execution Vulnerabilities

   What is the Vulnerability? The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP's internal request-processing and memory-management…

   EPSS 1.00 Fix available CVE-2026-109618CVE-2026-109619CVE-2026-115560 PHP
5. 37
   CCCS advisory CCCS 8d ago

   AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619

   EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560
6. 34
   News The Register 8d ago

   There's a third PHP2Shell bug, but it won't get an emergency fix

   Bad things (and software bugs?) come in threes

   EPSS 1.00 CVE-2026-115560CVE-2026-109618CVE-2026-109619 PHP
7. 34
   Research Cloudflare 10d ago

   Cloudflare deploys protections against php2shell vulnerability

   Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed…

   EPSS 1.00 CVE-2026-115560CVE-2026-109618CVE-2026-109619+1 more Cloudflare PHP
8. 33
   Research Check Point Research 5d ago

   26th October – Threat Intelligence Report

   For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a…

   EPSS 1.00 CVE-2026-109618CVE-2026-109619CVE-2026-115560+2 more