Vulnerability report

Active exploitation observed Confirmed confidence Not in CISA KEV

CVE-2026-109618

PHP RCE Remote Code Execution

PHP Group / PHP · affected before 8.2.35

Watch CVE-2026-109618 Browse KEV feed
Severity
CVSS 9.2 · Critical
Confidence
Confirmed
Exploit status
Observed in sensors
EPSS
—
First observed
21 Oct 2026
Last observed
22 Oct 2026

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-109618 is an unauthenticated vulnerability affecting PHP Group PHP. PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not...

Is it exploited?

Yes. Previdian sensors observed exploitation attempts with confirmed confidence. Also confirmed by third-party sources.

Who is affected?

PHP Group / PHP affected before 8.2.35.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation.

The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP Group Affected
PHP php-src
Before 8.2.35 Before 8.3.36 Before 8.4.27 Before 8.5.12
View vendor advisory (opens in new tab)
Published
21 Oct 2026
Exploitation Reported
21 Oct 2026
Attack vector
Remote
Complexity
High
Privileges
None
User interaction
None

Tags

php nuclei_scanner

CVE References

  • CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-109618
  • GitHub — php/php-src github.com · Vendor Advisory https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

Previdian

Recorded 21 Oct 2026

Previdian independently recorded this as exploited after first seeing it in honeypot sensors.

Active exploitation observed

Previdian sensor

First observed 21 Oct 2026

Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.

Proof of concept available

GitHub

Recorded 21 Oct 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
Previdian Sensors First 2026-10-21 15:43 UTC
SOCRadar 2026-10-21 16:20 UTC
The Hacker News 2026-10-21 17:32 UTC
Tenable Blog 2026-10-22 04:20 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

First-party evidence of exploitation activity

Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.

31

Attempts observed

12

Unique attacker IPs

11

Attacker countries

AE · AT · CN · DE · EE · FI · FR · NP · RU · SG · US

17

Sensors observed

CVE-2026-109618 exploitation attempts over the last 7 days

Daily events observed by Previdian sensors

Updated 22 Oct 2026

0
0
0
0
0
28
3
16 Oct 17 Oct 18 Oct 19 Oct 20 Oct 21 Oct 22 Oct

First observed 21 Oct 2026 · Last observed 22 Oct 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Start 14-day Pro trial

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
2
8
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Virtual patch status

Previdian virtual patch guidance is available for this CVE.

AWS WAF Cloudflare ModSecurity

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-109618.yaml 22 Oct 2026

Virtual Patch Detail

Compensating WAF rules for this CVE.

Available

Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to Previdian Enterprise users.

Talk to Sales Learn About Virtual Patches

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

9.2 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

—

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improperly Controlled Sequential Memory Allocation CWE-1325 Incorrect Initialization of Resource CWE-1419 Use After Free CWE-416 Improper Handling of Exceptional Conditions CWE-755 Access of Uninitialized Pointer CWE-824

Recent mention · Wordfence

Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP. The post Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our...

Read full advisory

All CVSS Scores

CVSS v4.0 9.2 Critical

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All Mentions

Recent mention · Wordfence

Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found

Wordfence · 22 Oct 2026

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP. The post Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found appeared first on Wordfence.

Recent mention · TheRegister

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

TheRegister · 21 Oct 2026

'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg

Recent mention · Arctic Wolf

Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure

Arctic Wolf · 21 Oct 2026

On Tuesday, October 20, threat actors gained advance visibility into two critical PHP vulnerabilities after details leaked ahead of the planned disclosure, accelerating the race between defenders and attackers. The flaws are tracked as Common Vulnerabilities and Exposures (CVE) identifiers CVE-2026-109618 and CVE-2026-109619. Together they’re known as PHP2Shell. Both carry a 9.2 rating on the ... Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure

Recent mention · Citrix

Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619

Citrix · 21 Oct 2026

Immediate mitigation guidance for NetScaler customers By NetScaler Product Security NetScaler is impacted by two PHP memory safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because the NetScaler Management Portal uses PHP. Citrix is actively working to upgrade the PHP software package to a fixed version. We will update this post when the fix becomes available. As recommended in NetScaler’s Secure Deployment Guide, management interfaces must be logically or physically isolated from data traffic, completely blocked from the Internet, and restricted via ACLs to trusted...

Recent mention · Cisco Security Advisory

Vulnerabilities in PHP Affecting Cisco Products: October 2026

Cisco Security Advisory · 21 Oct 2026

On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq Security Impact...

Recent mention · The Record

PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024

The Record · 21 Oct 2026

In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies heightened attention on both, why it scrambled to post information earlier than planned.

Recent mention · Wordfence

PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now

Wordfence · 21 Oct 2026

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. We recommend making sure every site you manage is running a patched version of PHP as soon as possible. The post PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now appeared first on Wordfence.

Recent mention · F5 Security Advisories

K000163821: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

F5 Security Advisories · 21 Oct 2026

Security Advisory Description CVE-2026-109618 (also known as php2shell) PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). CVE-2026-109619 (also known as php2shell) PHP has various global state that temporarily...

Recent mention · Palo Alto Networks Security Advisories

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)

Palo Alto Networks Security Advisories · 21 Oct 2026

Recent mention · Rapid7

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Rapid7 · 21 Oct 2026

OverviewOn October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges.CVECVSSv4DescriptionCVE-2026-1096189.2 (Critical)RCE via OOM corruptionCVE-2026-1096199.2 (Critical)RCE via stale global stateAll installations serving web requests are at risk, including...

Recent mention · Cisco Talos Blog

Two critical RCEs in PHP core

Cisco Talos Blog · 21 Oct 2026

Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial

Recent mention · TheRegister

PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

TheRegister · 21 Oct 2026

Websites down as precaution as exploits have already been published

Recent mention · CyberInsider

PHP releases emergency fixes for critical PHP2Shell vulnerabilities

CyberInsider · 21 Oct 2026

PHP has released emergency security updates that address two critical vulnerabilities, collectively known as PHP2Shell. The flaws could allow unauthenticated attackers to execute code on vulnerable web servers. Administrators should update immediately, as configuration changes cannot fully mitigate the flaws. The security announcement confirms that PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes. Tracked … The post PHP releases emergency fixes for critical PHP2Shell vulnerabilities appeared first on CyberInsider.

Recent mention · The Record

Hundreds of websites taken offline as concern grows over two PHP vulnerabilities

The Record · 21 Oct 2026

The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.

Recent mention · CERT Polska

Krytyczne podatności w PHP umożliwiające zdalne wykonanie kodu - php2shell

CERT Polska · 21 Oct 2026

Zespół CERT Polska ostrzega przed dwiema krytycznymi podatnościami w oprogramowaniu PHP, oznaczonymi identyfikatorami CVE-2026-109618 oraz CVE-2026-109619. Luki pozwalają atakującemu na zdalne wykonanie dowolnych poleceń systemowych poprzez błędy w mechanizmie zarządzania pamięcią. Podatne są wszystkie wersje PHP od 5.4 w górę. Przypominamy, że język programowania PHP jest wykorzystywany również przez wiele rodzajów popularnego oprogramowania, np. WordPress, Joomla czy WooCommerce. Oznacza to, że systemy wykorzystujące to oprogramowanie również są podatne. Jedyną skuteczną metodą ochrony...

Recent mention · BleepingComputer

PHP ships emergency patches for critical PHP2Shell flaws

BleepingComputer · 21 Oct 2026

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]

Recent mention · NCSC Security Advisories

NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHP

NCSC Security Advisories · 21 Oct 2026

PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen. De kwetsbaarheid met kenmerk CVE-2026-109618 betreft geheugenbeschadiging bij de afhandeling van een Out-of-Memory-situatie. Hierdoor kunnen interne requestgegevens slechts gedeeltelijk worden geïnitialiseerd en tijdens de verwerking als geldige gegevens worden behandeld, wat kan leiden tot Remote Code Execution. De kwetsbaarheid met kenmerk CVE-2026-109619...

Recent mention · Palo Alto Unit42

“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities

Palo Alto Unit42 · 21 Oct 2026

An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.

Recent mention · Check Point Blog

php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Check Point Blog · 21 Oct 2026

What happened? On October 20, a post on Hacker News claimed that two critical remote code execution (RCE) vulnerabilities in PHP – tracked by researchers as CVE-2026-109618 and CVE-2026-109619 – would be publicly disclosed on Thursday, October 22, before any patch was available. The post was taken down, but screenshots had already spread across social media. Researchers at watchTowr then confirmed the leaked information was real and that the flaws were under embargo, and reported reproducing CVE-2026-109618. That evening (19:33 UTC), the PHP security team published an advance notice of an...

Recent mention · Palo Alto Unit42

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619

Palo Alto Unit42 · 21 Oct 2026

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42.

Recent mention · Wiz

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Wiz · 21 Oct 2026

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

Recent mention · NCSC Alerts and Advisories

Critical security issue affecting PHP

NCSC Alerts and Advisories · 21 Oct 2026

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

Recent mention · SOCRadar

PHP2Shell: CVE-2026-109618 & CVE-2026-109619

SOCRadar · 21 Oct 2026

PHP2Shell is the name researchers now use for two critical vulnerabilities in PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and many custom web applications. Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws reportedly allow Remote Code Execution (RCE), and the PHP security team rated each 9.2 on CVSS v4.0. The flaws surfaced ahead of […]

Recent mention · Security Affairs

PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws

Security Affairs · 21 Oct 2026

PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems. PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC, […]

Recent mention · Tenable Blog

php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Tenable Blog · 21 Oct 2026

Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches.Key takeawaysCVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities.watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging.The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version...

Recent mention · CERT Polska

Krytyczne podatności w PHP umożliwiające zdalne wykonanie kodu

CERT Polska · 21 Oct 2026

Zespół CERT Polska ostrzega przed dwiema krytycznymi podatnościami w oprogramowaniu PHP, które pozwalają na zdalne wykonanie kodu.Są one oznaczone identyfikatorami CVE-2026-109618 oraz CVE-2026-109619. Podatne są wszystkie wersje PHP od 5.0 w górę. Przypominamy, że język programowania PHP jest wykorzystywany również przez popularne oprogramowanie, np. WordPress, Joomla czy PHPMyAdmin. Oznacza to, że systemy wykorzystujące to oprogramowanie również są podatne i bezwzględnie muszą zostać zaktualizowane po publikacji nowej wersji PHP.Rekomendowanym działaniem jest aktualizacja oprogramowania...

Recent mention · FortiGuard

PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

FortiGuard · 21 Oct 2026

CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Revised on 2026-10-21 00:00:00

Recent mention · The Hacker News

Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

The Hacker News · 21 Oct 2026

Ravie LakshmananOct 21, 2026Cyber Attack / Web Security Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managing multiple sites remotely. A client component of UpdraftCentral is shipped within every copy of...

Recent mention · The Hacker News

PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge

The Hacker News · 21 Oct 2026

Swati KhandelwalOct 21, 2026Vulnerability / Web Security PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code...

Recent mention · The Hacker News

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

The Hacker News · 21 Oct 2026

Swati KhandelwalOct 21, 2026Vulnerability / Web Security PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far. The advance notice followed a leak. On October 20, a post on HN said two PHP remote code execution flaws, rated CVSS 10.0 and affecting...

Recent mention · RecordedFuture

PHP2Shell Exploitation: Two Critical PHP Flaws Explained

RecordedFuture · 21 Oct 2026

Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now.

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

pattingbabies/php2shell-CVE-2026-109618-109619

github · Created 2026-10-22 05:20:36 UTC · 1 stars · AI assessment 84%

Full 1:1 reproduction of php2shell (CVE-2026-109618 / CVE-2026-109619): pre-auth PHP RCE via session.upload_progress OOM corruption and stale cross-request state. Pinned mod_php 8.4.26 / Apache 2.4.69 aarch64 lab, pure HTTP, heap-layout ASLR bypass, no brute force.

basesixtythree/B63-POC-CVE-2026-109618

github · Created 2026-10-21 22:30:48 UTC · 0 stars · AI assessment 82%

PoC and verification material for CVE-2026-109618 (PHP OOM bailout state corruption)

EngOREOO/php2shell-CVE-2026-109618-CVE-2026-109619-PoC

github · Created 2026-10-21 17:00:41 UTC · 1 stars · AI assessment 84%

Working local PoC for the php2shell PHP RCE pair (CVE-2026-109618, CVE-2026-109619): unauthenticated remote code execution via session.upload_progress multipart OOM in Apache mod_php. Docker A/B lab (8.4.26 vs 8.4.27), exploit patch for emulated x86-64, and patch-verification methodology.

nirzadokox/php2shell-vulnerability-check-for-CVE-2026-109618-CVE-2026-109619

github · Created 2026-10-21 16:19:54 UTC · 0 stars · AI assessment 84%

vulnerability check for CVE-2026-109618 / CVE-2026-109619

lzz0403/CVE-2026-109618-PHP2Shell-poc

github · Created 2026-10-21 15:31:03 UTC · 1 stars · AI assessment 82%

PHP 8.2.6 + Apache mod_php

xuehuolll/php2shell-CVE-2026-109618-109619

github · Created 2026-10-21 04:38:46 UTC · 6 stars · AI assessment 84%

CVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.

PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Vulnerable Version Detection

nuclei · Created Unknown

Timeline

From disclosure to observed exploitation

  1. 04:30 UTC

    Nuclei template available

    Scanner coverage available

  2. 04:20 UTC

    KEV confirmed by Tenable Blog

    Exploitation attested by an external source

  3. 19:57 UTC

    Indicators of compromise added (10)

    Indicators of compromise recorded

  4. 17:32 UTC

    KEV confirmed by The Hacker News

    Exploitation attested by an external source

  5. 16:20 UTC

    KEV confirmed by SOCRadar

    Exploitation attested by an external source

  6. 15:15 UTC

    Virtual patch available

    Compensating WAF rule available to block exploitation

  7. 13:48 UTC

    CVE published

    Vulnerability disclosed publicly

  8. 13:05 UTC

    Observed by Previdian sensors

    Evidence-backed exploitation signal

  9. 04:38 UTC

    Public PoC available

    Public proof-of-concept code published

  10. 19:33 UTC

    Added to the Previdian watchlist

    Pro and Enterprise Watch users had 1 day of early warning before Previdian confirmed it as a KEV.

  11. 21:03 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-109618

Sample API response 
{
  "cve_id": "CVE-2026-109618",
  "confidence": "Confirmed",
  "cvss_score": 9.2,
  "cvss_estimated": false,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 31, "sensors": 17 }
}