Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow]
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.
Read at SANS Internet Storm Center
- Vendor
- PHP
- Product
- PHP
- CVSS
- 9.4
- EPSS
- 1.00 (p100)
- Exploitation
- public exploit code reported
- Exposure class
- Web platform
Why it ranks 66 (High)
- Public exploit code reported
- CVSS 9.4 critical
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Covered by 34 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- SANS Internet Storm Center (isc.sans.edu)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.