Censys takes census of the Internet like no one else
Key Takeaways: A messy week for PHP: how PHP2Shell was disclosed On October 20, PHP announced an emergency release for two pre-auth remote code execution (RCE) flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. These two vulnerabilities together came to be known as “PHP2Shell.” That evening, Calif, one of the research […] The post Censys takes census of the Internet like no one else appeared first on Censys .
- Vendor
- PHP
- Product
- PHP
- CVSS
- 9.2
- EPSS
- 1.00 (p100)
- Exposure class
- Web platform
Why it ranks 58 (High)
- CVSS 9.2 critical
- EPSS 1.00 (high probability of exploitation)
- Product class: web platform
- Covered by 38 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Censys research (censys.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.