What it is
CVE-2026-109619 is an unauthenticated vulnerability affecting PHP Group PHP. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may...
Vulnerability report
Active exploitation observed
Confirmed confidence
Not in CISA KEV
CVE-2026-109619
PHP RCE Remote Code Execution
PHP Group / PHP · affected before 8.2.35
- Severity
- CVSS 9.2 · Critical
- Confidence
- Confirmed
- Exploit status
- Observed in sensors
- EPSS
- 5.8%
- First observed
- 21 Oct 2026
- Last observed
- 23 Oct 2026
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Is it exploited?
Yes. Previdian sensors observed exploitation attempts with confirmed confidence. Also confirmed by third-party sources.
Who is affected?
PHP Group / PHP affected before 8.2.35.
What should we do?
Patch immediately, validate internet-facing exposure, and monitor for matching requests.
Overview
PHP has various global state that temporarily points into request memory
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed.
Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Vendor
Product
Affected
Status
PHP Group
Affected
PHP
php-src
Before 8.2.35
Before 8.3.36
Before 8.4.27
Before 8.5.12
Affected
- Published
- 21 Oct 2026
- Exploited Since
- 21 Oct 2026
- Attack vector
- Remote
- Complexity
- High
- Privileges
- None
- User interaction
- None
Tags
php
ios
mirai
malware
CVE References
- CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-109619
- GitHub — php/php-src github.com · Vendor Advisory https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
Exploitation evidence
Why Previdian marks this CVE as exploited
Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.
Exploited in the wild
Security Affairs
Previdian independently recorded this as exploited after first seeing it in honeypot sensors.
Active exploitation observed
Previdian sensor
Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.
Used in mirai malware
Security Affairs
Malware families have been linked to exploitation of this CVE.
Proof of concept available
GitHub
Public scanner or PoC coverage increases practical exploitability.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| Security Affairs First | 2026-10-22 20:30 UTC |
| Previdian Sensors | 2026-10-22 20:30 UTC |
| Tenable Blog | 2026-10-22 21:20 UTC |
| SOCRadar | 2026-10-22 21:20 UTC |
| TheRegister | 2026-10-22 21:21 UTC |
| The Hacker News | 2026-10-23 07:30 UTC |
Operational indicators for this CVE are listed under Detection.
Sensor telemetry
First-party evidence of exploitation activity
Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.
5
Attempts observed
4
Unique attacker IPs
4
Attacker countries
DE · FR · NL · US
3
Sensors observed
CVE-2026-109619 exploitation attempts over the last 7 days
Daily events observed by Previdian sensors
Updated 23 Oct 2026
17 Oct
18 Oct
19 Oct
20 Oct
21 Oct
22 Oct
23 Oct
First observed 21 Oct 2026 · Last observed 23 Oct 2026
Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Observed signals
- Request targets
- User-Agents
- Callback hosts
- 3
- 2
- 0
Request targets and User-Agents available in Pro. Callback host details available in Enterprise.
Scanner coverage
No scanner integrations recorded yet.
Virtual patch status
Previdian virtual patch guidance is available for this CVE.
AWS WAF
Cloudflare
ModSecurity
Attacker IP Indicators
Attacker IP indicators observed · available in Pro and Enterprise.
Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.
Learn about Pro API accessVirtual Patch Detail
Compensating WAF rules for this CVE.
Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to Previdian Enterprise users.
Risk and context
Severity, weaknesses, and research context
CVSS v4.0
9.2
Critical
Potential damage if exploited. Separate from whether attackers are using it.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
5.8%
Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.
Weaknesses
Recent mention · The Hacker News
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The...
Read full advisoryAll CVSS Scores
CVSS v4.0
9.2
Critical
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS v3.1
8.1
High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
All Mentions
Recent mention · The Hacker News
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwareThe Hacker News · 23 Oct 2026
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote
Recent mention · Wordfence
Attacks on PHP2Shell Continue, But No Known Compromises as a Result YetWordfence · 22 Oct 2026
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any confirmed compromises resulting from these vulnerabilities, which is a clear indicator of this exploit's complexity considering Wordfence secures over 5,000,000 WordPress websites. We are continuing to closely monitor the...
Recent mention · Tenable Blog
The adversary economy: How threat actors are reacting to PHP2ShellTenable Blog · 22 Oct 2026
Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target.Key takeawaysThe adversary economy operates on the same fundamental principles as the legitimate economy. Forum self-evacuations: Criminal forums including BreachForums initiated emergency infrastructure migrations, taking themselves offline within hours of PHP2Shell disclosure, citing direct risk to their operations.Underground operators face a dual threat: both law...
Recent mention · TheRegister
PHP2Shell exploit bypasses protections designed to stop remote code executionTheRegister · 22 Oct 2026
“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.
Recent mention · Citrix
NetScaler WAF Signatures Update v186Citrix · 22 Oct 2026
NetScaler has released a new version of its integrated Web App Firewall signatures to help customers mitigate several CVEs with varying CVSS scores. CVE‑2026‑109618: is a critical remote code execution vulnerability in PHP’s handling of out-of-memory errors. PHP uses longjmp() to abort a request after memory exhaustion; in some execution paths, this can leave request memory uninitialized. During cleanup, PHP may read or branch on that memory, allowing a remote, unauthenticated attacker to execute arbitrary code by sending crafted web requests that trigger the condition. CVE2026-109619:...
Recent mention · Horizon3.ai Attack Research
PHP2Shell Exposure Depends on More Than Whether You Use PHPHorizon3.ai Attack Research · 22 Oct 2026
PHP2Shell exposure can extend into bundled runtimes, containers, and hosted applications. Learn why identifying affected PHP is only the first step toward validating exploitability.
Recent mention · Arctic Wolf
PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code ExecutionArctic Wolf · 22 Oct 2026
Executive Summary On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to by researchers as PHP2Shell. Both vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical Severity) and can allow an unauthenticated attacker to execute code with the privileges of the affected PHP ... PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution
Recent mention · Check Point Blog
PHP2Shell Update: One in ten organizations impacted as Europe bears the bruntCheck Point Blog · 22 Oct 2026
Two critical vulnerabilities in PHP, the programming language behind a large share of the world’s websites, online stores and internet services, are being actively targeted. Since details of CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, leaked ahead of planned disclosure, 10% of organisations worldwide have been impacted (“impacted” means exploitation attempts, we have no way of knowing if the attack has been successful), according to Check Point Research. Hourly activity peaks at midnight, when fewer security teams are watching. Government institutions in the Netherlands and...
Recent mention · Palo Alto Unit42
The Current Landscape of OAuth AttacksPalo Alto Unit42 · 22 Oct 2026
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42.
Recent mention · TheRegister
PHP2Shell puts dozens of UK government services out of serviceTheRegister · 22 Oct 2026
Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise
Recent mention · SOCRadar
PHP2Shell Exploit Tooling Found on Exposed Attacker ServerSOCRadar · 22 Oct 2026
SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an open, unauthenticated directory listing. The files show an operator turning the PHP2Shell vulnerabilities into practical attack tooling: a full remote code execution (RCE) chain built and tested in a lab, plus scripts that screen […]
Recent mention · Security Affairs
PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS ReportsSecurity Affairs · 22 Oct 2026
AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence. “Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot […]
Recent mention · TheRegister
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosureTheRegister · 22 Oct 2026
Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed
Recent mention · FortiGuard Center - Outbreak Alerts
PHP2Shell Remote Code Execution VulnerabilitiesFortiGuard Center - Outbreak Alerts · 22 Oct 2026
Successful exploitation could compromise the PHP application process and potentially provide access to sensitive server resources, application data, or databases, depending on the permissions of the affected process and the surrounding environment.
Recent mention · Wordfence
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing FoundWordfence · 22 Oct 2026
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP. The post Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found appeared first on Wordfence.
Recent mention · The Hacker News
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly DisclosedThe Hacker News · 22 Oct 2026
Ravie LakshmananOct 22, 2026Vulnerability / Threat Intelligence Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws are being broadly exploited in the wild following the release of the patches. "The exploit attempt originated from an IP address associated with a commercial anonymization network," CJ Moses, CISO of Amazon Integrated Security, said in a post shared with The Hacker News. "While the vulnerability was under embargo, the...
Recent mention · TheRegister
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at riskTheRegister · 21 Oct 2026
'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg
Recent mention · Arctic Wolf
Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell ExposureArctic Wolf · 21 Oct 2026
On Tuesday, October 20, threat actors gained advance visibility into two critical PHP vulnerabilities after details leaked ahead of the planned disclosure, accelerating the race between defenders and attackers. The flaws are tracked as Common Vulnerabilities and Exposures (CVE) identifiers CVE-2026-109618 and CVE-2026-109619. Together they’re known as PHP2Shell. Both carry a 9.2 rating on the ... Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure
Recent mention · Citrix
Protecting NetScaler Management Access from PHP CVE-2026-109618 & CVE 2026-109619Citrix · 21 Oct 2026
Immediate mitigation guidance for NetScaler customers By NetScaler Product Security NetScaler is impacted by two PHP memory safety vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because the NetScaler Management Portal uses PHP. Citrix is actively working to upgrade the PHP software package to a fixed version. We will update this post when the fix becomes available. As recommended in NetScaler’s Secure Deployment Guide, management interfaces must be logically or physically isolated from data traffic, completely blocked from the Internet, and restricted via ACLs to trusted...
Recent mention · Cisco Security Advisory
Vulnerabilities in PHP Affecting Cisco Products: October 2026Cisco Security Advisory · 21 Oct 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global state For information about these vulnerabilities, see the advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. These vulnerabilities are being referenced as PHP2shell. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq Security Impact...
Recent mention · The Record
PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024The Record · 21 Oct 2026
In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies heightened attention on both, why it scrambled to post information earlier than planned.
Recent mention · Wordfence
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update NowWordfence · 21 Oct 2026
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. We recommend making sure every site you manage is running a patched version of PHP as soon as possible. The post PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now appeared first on Wordfence.
Recent mention · F5 Security Advisories
K000163821: PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619F5 Security Advisories · 21 Oct 2026
Security Advisory Description CVE-2026-109618 (also known as php2shell) PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). CVE-2026-109619 (also known as php2shell) PHP has various global state that temporarily...
Recent mention · Palo Alto Networks Security Advisories
CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)Palo Alto Networks Security Advisories · 21 Oct 2026
Recent mention · Rapid7
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHPRapid7 · 21 Oct 2026
OverviewOn October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges.CVECVSSv4DescriptionCVE-2026-1096189.2 (Critical)RCE via OOM corruptionCVE-2026-1096199.2 (Critical)RCE via stale global stateAll installations serving web requests are at risk, including...
Recent mention · Cisco Talos Blog
Two critical RCEs in PHP coreCisco Talos Blog · 21 Oct 2026
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial
Recent mention · TheRegister
PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatchedTheRegister · 21 Oct 2026
Websites down as precaution as exploits have already been published
Recent mention · CyberInsider
PHP releases emergency fixes for critical PHP2Shell vulnerabilitiesCyberInsider · 21 Oct 2026
PHP has released emergency security updates that address two critical vulnerabilities, collectively known as PHP2Shell. The flaws could allow unauthenticated attackers to execute code on vulnerable web servers. Administrators should update immediately, as configuration changes cannot fully mitigate the flaws. The security announcement confirms that PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes. Tracked … The post PHP releases emergency fixes for critical PHP2Shell vulnerabilities appeared first on CyberInsider.
Recent mention · The Record
Hundreds of websites taken offline as concern grows over two PHP vulnerabilitiesThe Record · 21 Oct 2026
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Recent mention · CERT Polska
Krytyczne podatności w PHP umożliwiające zdalne wykonanie kodu - php2shellCERT Polska · 21 Oct 2026
Zespół CERT Polska ostrzega przed dwiema krytycznymi podatnościami w oprogramowaniu PHP, oznaczonymi identyfikatorami CVE-2026-109618 oraz CVE-2026-109619. Luki pozwalają atakującemu na zdalne wykonanie dowolnych poleceń systemowych poprzez błędy w mechanizmie zarządzania pamięcią. Podatne są wszystkie wersje PHP od 5.4 w górę. Przypominamy, że język programowania PHP jest wykorzystywany również przez wiele rodzajów popularnego oprogramowania, np. WordPress, Joomla czy WooCommerce. Oznacza to, że systemy wykorzystujące to oprogramowanie również są podatne. Jedyną skuteczną metodą ochrony...
Recent mention · BleepingComputer
PHP ships emergency patches for critical PHP2Shell flawsBleepingComputer · 21 Oct 2026
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...]
Recent mention · NCSC Security Advisories
NCSC-2026-0443 [1.00] [H/H] Kwetsbaarheden verholpen in PHPNCSC Security Advisories · 21 Oct 2026
PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen. De kwetsbaarheid met kenmerk CVE-2026-109618 betreft geheugenbeschadiging bij de afhandeling van een Out-of-Memory-situatie. Hierdoor kunnen interne requestgegevens slechts gedeeltelijk worden geïnitialiseerd en tijdens de verwerking als geldige gegevens worden behandeld, wat kan leiden tot Remote Code Execution. De kwetsbaarheid met kenmerk CVE-2026-109619...
Recent mention · Palo Alto Unit42
“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesPalo Alto Unit42 · 21 Oct 2026
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities appeared first on Unit 42.
Recent mention · Check Point Blog
php2shell: What We Know About the Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)Check Point Blog · 21 Oct 2026
What happened? On October 20, a post on Hacker News claimed that two critical remote code execution (RCE) vulnerabilities in PHP – tracked by researchers as CVE-2026-109618 and CVE-2026-109619 – would be publicly disclosed on Thursday, October 22, before any patch was available. The post was taken down, but screenshots had already spread across social media. Researchers at watchTowr then confirmed the leaked information was real and that the flaws were under embargo, and reported reproducing CVE-2026-109618. That evening (19:33 UTC), the PHP security team published an advance notice of an...
Recent mention · Palo Alto Unit42
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619Palo Alto Unit42 · 21 Oct 2026
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42.
Recent mention · Wiz
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the InternetWiz · 21 Oct 2026
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
Recent mention · NCSC Alerts and Advisories
Critical security issue affecting PHPNCSC Alerts and Advisories · 21 Oct 2026
Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
Recent mention · SOCRadar
PHP2Shell: CVE-2026-109618 & CVE-2026-109619SOCRadar · 21 Oct 2026
PHP2Shell is the name researchers now use for two critical vulnerabilities in PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and many custom web applications. Tracked as CVE-2026-109618 and CVE-2026-109619, both flaws reportedly allow Remote Code Execution (RCE), and the PHP security team rated each 9.2 on CVSS v4.0. The flaws surfaced ahead of […]
Recent mention · Security Affairs
PHP Prepares Emergency Fixes for Two Critical Remote Code Execution FlawsSecurity Affairs · 21 Oct 2026
PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems. PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC, […]
Recent mention · Tenable Blog
php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilitiesTenable Blog · 21 Oct 2026
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches.Key takeawaysCVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP, both rated CVSSv4.0 9.2 by the PHP security team. Public reporting describes both as remote code execution vulnerabilities.watchTowr says it believes it has reproduced CVE-2026-109618, and Cloudflare CTO Dane Knecht says the company is seeing early attacks emerging.The patch release is scheduled for October 21, 2026 at 14:00 UTC. Version...
Recent mention · CERT Polska
Krytyczne podatności w PHP umożliwiające zdalne wykonanie koduCERT Polska · 21 Oct 2026
Zespół CERT Polska ostrzega przed dwiema krytycznymi podatnościami w oprogramowaniu PHP, które pozwalają na zdalne wykonanie kodu.Są one oznaczone identyfikatorami CVE-2026-109618 oraz CVE-2026-109619. Podatne są wszystkie wersje PHP od 5.0 w górę. Przypominamy, że język programowania PHP jest wykorzystywany również przez popularne oprogramowanie, np. WordPress, Joomla czy PHPMyAdmin. Oznacza to, że systemy wykorzystujące to oprogramowanie również są podatne i bezwzględnie muszą zostać zaktualizowane po publikacji nowej wersji PHP.Rekomendowanym działaniem jest aktualizacja oprogramowania...
Recent mention · FortiGuard
PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)FortiGuard · 21 Oct 2026
CVSSv3 Score: 9.8 CVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Revised on 2026-10-21 00:00:00
Recent mention · The Hacker News
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress SitesThe Hacker News · 21 Oct 2026
Ravie LakshmananOct 21, 2026Cyber Attack / Web Security Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote management service that's used for managing multiple sites remotely. A client component of UpdraftCentral is shipped within every copy of...
Recent mention · The Hacker News
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertThe Hacker News · 21 Oct 2026
Swati KhandelwalOct 21, 2026Vulnerability / Web Security PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described. Security researchers at watchTowr say the two flaws allow remote code execution. Only the four supported PHP branches, 8.2 through 8.5, can receive the fix, and no exploitation has been reported so far. The advance notice followed a leak. On October 20, a post on HN said two PHP remote code execution flaws, rated CVSS 10.0 and affecting...
Recent mention · The Hacker News
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts EmergeThe Hacker News · 21 Oct 2026
Swati KhandelwalOct 21, 2026Vulnerability / Web Security PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the PHP runtime, not in any application, so a site is exposed even when its own code is secure. The risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code...
Recent mention · RecordedFuture
PHP2Shell Exploitation: Two Critical PHP Flaws ExplainedRecordedFuture · 21 Oct 2026
Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now.
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
unlimit0118/CVE-2026-109619-php2shell-poc
github · Created 2026-10-21 16:51:07 UTC · 2 stars · AI assessment 82%
Minimal PHP session upload progress use-after-free PoC and Docker lab.
santihabib/CVE-2026-109619
github · Created 2026-10-21 14:05:29 UTC · 0 stars · AI assessment 84%
Cross-request use-after-free in PHP session.upload_progress (CVE-2026-109619) — root-cause analysis and reproducer for PHP 8.5.11
Timeline
From disclosure to observed exploitation
-
08:21 UTC
Used in mirai malware
Exploit observed in malware
-
07:30 UTC
KEV confirmed by The Hacker News
Exploitation attested by an external source
-
21:21 UTC
KEV confirmed by TheRegister
Exploitation attested by an external source
-
21:20 UTC
KEV confirmed by SOCRadar
Exploitation attested by an external source
-
21:20 UTC
KEV confirmed by Tenable Blog
Exploitation attested by an external source
-
20:30 UTC
Added to Previdian KEV Feed
High-confidence, third-party attested exploitation
-
15:15 UTC
Virtual patch available
Compensating WAF rule available to block exploitation
-
14:22 UTC
Indicators of compromise added (4)
Indicators of compromise recorded
-
14:07 UTC
Observed by Previdian sensors
Evidence-backed exploitation signal
-
14:05 UTC
Public PoC available
Public proof-of-concept code published
-
13:54 UTC
CVE published
Vulnerability disclosed publicly
-
19:33 UTC
Added to the Previdian watchlist
Pro and Enterprise Watch users had 2 days of early warning before Previdian confirmed it as a KEV.
-
21:04 UTC
CVE ID reserved
Identifier reserved by the CNA
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2026-109619
Sample API response{
"cve_id": "CVE-2026-109619",
"confidence": "Confirmed",
"cvss_score": 9.2,
"cvss_estimated": false,
"epss_score": 0.05757,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": true
},
"sensor_telemetry": { "attempts": 5, "sensors": 3 }
}